Rekey
MIT licensed · free to self-host

Auth and billing that you run, not rent.

A user's login and their subscription live in one record — you never reconcile who's paid with who's signed in, because there was never a second system to drift.

You run it yourself, and the data stays in your Postgres. It's from a small team, MIT licensed, with the source on GitHub if you want to read it before you trust it.

Get started — $99/monthOr self-host it free

New to Rekey? See how the operator panel works

No per-MAU meter · MIT licensed · the source is on GitHub

1 stack
one compose command
Multi-tenant
every row has appId
MCP
agent-ready
The status quo

When auth and billing live in two places, they drift

Most teams wire an auth provider to a payments provider with hand-written webhooks. Then the two records disagree: a paying customer gets locked out, or access lingers after a payment fails. Keeping them in sync is the part nobody wants to own.

Two systems, two records of the same user

The auth side knows who logged in. The billing side knows who paid. Webhooks land out of order, and the reconciliation code that keeps the two agreeing is yours to write and yours to debug.

Pricing that assumes you ship one app

Per-MAU meters assume a single product. Ship a second app that shares users, and you pay twice for the same people, plus a per-seat charge for your own team.

Your data lives in someone else's database

Identities, subscription history, and webhook receipts sit inside the vendor. Exporting them is possible on paper and painful in practice once you have real volume.

Agents can't read the account data

When a user's agent wants to check their plan or recent payments, the usual answer is a static admin key with full access. There's no scoped, read-only way to hand it just the account it's allowed to see.

How Rekey fits

Auth and billing behind one API you host

Rekey is a self-hostable service that keeps auth and billing in one tenant model, so a user's login and their plan don't drift apart. You bring the payment processor and keep your own account; Rekey keeps the data, the panel, and the SDKs in your infrastructure.

One command to self-host

`docker compose --profile full up` boots the API, Postgres, Redis, and the panel. The same image runs in production, and the Postgres is yours.

One tenant model for identity and entitlements

A Tenant owns one or more Applications. Login and subscription state share that model: access checks read the record that payment webhooks write, so there's no second copy to drift. Every row carries `applicationId`.

Bring your own payment processor

Stripe, PayPal, and Razorpay sit behind one `BillingProvider` interface, set per Application. You change a config value, not your billing code. Provider-specific fields live in `metadata`.

Built for agents — read and operate

A user's agent reads their own account over scoped OAuth 2.1 (read-only). And an operator MCP lets your agent run the workspace — read metrics, create apps, configure billing, cancel subscriptions — behind explicit, scoped consent (read / write / admin). No static admin key changes hands. Connect Claude, Cursor, or Claude Code to your own instance; the end-user MCP is off by default, so enable it per Application in the panel.

See the full architecture in the docs
Walkthrough

See Rekey end to end

From an empty workspace to a live app with auth and billing — the operator panel, the SDKs, and the agent surface, in one pass.

Read the operator-panel walkthrough →
Modules

What Rekey does, and what it doesn't

Rekey does auth and billing. It doesn't ship a CRM, an email blaster, or a feature-flag service. Pair it with the tools you already run.

Auth

  • Email + password
  • OAuth — Google, GitHub, plus 5+ providers via OIDC
  • MFA with TOTP + downloadable backup codes
  • Refresh-token rotation + session revocation
  • End-user roles per Application (RBAC) with default-role enforcement
  • WebAuthn / passkeys — register, sign in, and revoke
  • JWKS endpoint + opt-in RS256 — verify tokens offline at the edge, no API round-trip

Billing

  • Subscription, License, Usage, and Credit plan kinds
  • Stripe, PayPal, and Razorpay all live behind one interface
  • BYO provider credentials per Tenant (encrypted at rest)
  • Customer self-service portal — subscriptions, payments, plan changes, cancellation
  • Revenue dashboard — MRR, churn, and a 12-month trend per Application
  • Automatic dunning — scheduled failed-payment reminders + recovery tracking
  • Applications carry an environment — production, staging, or development; separate Applications keep real customers and rehearsals apart
  • Geographic routing across providers
  • Webhook receipts persisted + replayable from the panel
  • Coupons + discounts live; trials and proration are planned, not built

Usage & Licenses

  • Track any metric — API calls, MB ingested, model tokens
  • Auto-bill against usage plans
  • License keys issued on plan activation, validated by SDK
  • Per-Application meter definitions with units + aggregation
  • Real-time meter dashboard in the panel
  • Per-user GDPR/DSAR JSON export + audit-log CSV export live; bulk user export planned

Developer experience

  • Typed SDKs: `@rekey.dev/node`, `@rekey.dev/react`, `@rekey.dev/nextjs`
  • Operator MCP to run your workspace from an agent — read tools (`list_applications`, `recent_payments`, `application_health`) plus scoped write/admin tools (`create_application`, `configure_billing_provider`, `cancel_subscription`) behind explicit OAuth consent, and a separate read-only end-user MCP over OAuth 2.1 that you enable per Application in the panel
  • `@rekey.dev/cli` — non-interactive, `--json` everywhere
  • Every error carries `code`, `message`, and `fix:`
  • `Idempotency-Key` header support on mutating endpoints — retry safely, never double-charge
  • A typed catalog of auth, billing, and dunning webhook events with a signature-verification helper
  • Per-application team roles — admin, billing-manager, and viewer grants for workspace members
  • OpenAPI spec served at `/docs` on every running instance
  • Operator panel built in Next.js — Cmd+K palette, onboarding checklist, audit-log CSV export
Self-host

Run the whole stack in one command

API, operator panel, Postgres, and Redis come up together. Point a domain at it, and you own your auth and billing end to end.

  • Postgres is yours — auth and billing data never leaves your infra.
  • No per-MAU meter. MIT licensed. Read and audit every line.
  • One image runs in dev and prod; deploy on a VPS or Dokploy.
Read the self-host guide
terminal
git clone github.com/rekey-dev/rekey
cd rekey && cp .env.example .env
# set JWT_SECRET, ENCRYPTION_KEY, SUPER_ADMIN_KEY

docker compose --profile full up -d
# → API :3030 · panel :3031
Pricing

Free to self-host. $99 per workspace if you'd rather not.

Self-hosting is free and always will be — one docker compose command, unlimited Applications, Tenants, and end-users, and the Postgres is yours. Rekey Cloud is the same product run by us, billed per workspace: one production application, unlimited development and staging.

Free to self-host (MIT licensed) · Rekey Cloud $99 per workspace / month

Self-host

Run the whole stack yourself. The recommended path today.

Free/forever
  • Build the stack from source with Docker Compose — API, panel, SDKs
  • Unlimited Applications, Tenants, end-users
  • Bring your own Postgres + Redis
  • Bring your own Stripe / PayPal / Razorpay keys
  • Community support on Discord and GitHub
  • MIT licensed

No per-MAU meter; the Postgres is yours

Read the self-host guide
Recommended

Rekey Cloud

The same product, run by us. One workspace, billed monthly — development and staging applications are free and uncounted.

$99/workspace / month
  • One production application per workspace
  • Unlimited development + staging applications
  • Up to 100,000 monthly active users per workspace (fair use)
  • No per-seat fees — invite the whole team
  • Operator MCP endpoint for your AI agents
  • We run the Postgres, the upgrades, and the infrastructure
  • Email support from the team

Billed per workspace — not per seat, not per login. Want a free trial first? Get in touch.

Get started — $99/month

Enterprise self-host

Self-host with a named support contact and roadmap input.

Custom/annual contract
  • Everything in Self-host
  • Named support contact
  • Early access to in-flight modules
  • Roadmap input

For teams that need a named contact. On the roadmap, not built yet: SAML, LDAP, and SCIM.

Get in touch

Common questions

If yours isn't here, ask through the contact form. This page gets updated from real questions.

Self-host, the SDKs on npm, and the API are available today, MIT licensed and free with no limits. Rekey Cloud is $99 per workspace per month — one production application, unlimited development and staging — and subscribing provisions your workspace immediately. Want a free trial on our infrastructure first, or enterprise terms? Get in touch and we'll arrange it. The license is settled: MIT.

MIT licensed

Run your auth and billing. Don't rent them.

If you'd rather not glue two vendors together and reconcile them by hand, run it yourself or read the source first. Want us to run it instead? That's Rekey Cloud, $99 per workspace per month.

Get started — $99/monthOr self-host it free

Rekey Cloud from $99/month per workspace · self-hosting is free under MIT