Rekey

Ship your app without building sign-in and billing first.

Accounts, subscriptions, credits and usage limits come in one API, and who signed in and what they paid for is one record. Logins are never counted or billed.

Start free on Rekey CloudSelf-host for free

No card. One app in production on the free plan.

Self-hosting is free under MIT · the source is on GitHub

One customer of yours · sign-in and spend in one bookcredits, in your own Postgres
01end_user.created[email protected]role: default, enforced1,500
02mcp.consentClaude Code · get_creditsPKCE S256 · RFC 75911,500
03usage.recordtool callswithin included quota1,460
04credits.consumemodel tokensatomic · idempotent0
05credits.consumemodel tokens402 CREDITS_INSUFFICIENT0
The balance never goes negative. The call stops instead.402 · never a negative balance
The panel, MCP results, CLI output and errors are real, from a local stack. The captions are on the picture, so it works with the sound off.
Read the script

Sign-in from one vendor.

Billing from another.

Emails and licences from two more.

Each keeps its own list of users, and sooner or later they disagree about who has paid.

So your coding agent writes the glue, and the sign-in mostly works.

Rekey puts it all behind one API, so each customer is one record.

Now your agent builds on it directly.

The Next.js package ships an AGENTS.md written for it.

From Claude Code or Cursor, it creates the app and its plans over MCP.

When a call fails, the error carries a code and a fix it can act on.

For billing, plans and credits work the same on Stripe, PayPal or Razorpay.

Roles, emails and signed webhooks come built in.

Building for the desktop?

Sessions are bound to the device, and licence keys activate per machine.

And your users can connect Claude or Cursor to your app, signed in as themselves.

The weeks of plumbing go into the part your users came for.

  1. Two weeks on password resets

    Sign-up, sessions, reset emails, MFA and OAuth. None of it is what your customers pay you for.

    With Rekey

    Email and password, magic links, TOTP MFA and OAuth for Google, GitHub, Microsoft, Discord, GitLab, Slack or any OIDC provider. You switch them on in the panel.

    sessions rotate, reuse revokes all

  2. Then billing takes the next two

    Plans, failed payments, refunds, and a webhook you have to make idempotent before it charges someone twice.

    With Rekey

    Subscription, usage, credit and licence plans on Stripe, PayPal or Razorpay behind one interface. Or no processor at all while you build, and grant plans by hand.

    BillingProvider, per Application

  3. Two records of the same person

    Auth knows who signed in. Billing knows who paid. The code that keeps them agreeing is yours to debug.

    With Rekey

    Sign-in and subscription are one record. Your access check reads what the payment webhook wrote, so there is nothing to keep in sync.

    GET /api/v1/billing/entitlements

  4. An agent spends past its plan

    The run burns through the credits and nothing stops it. You find out from the invoice.

    With Rekey

    Credits debit atomically. A spend past zero is refused with a 402 instead of going negative, and usage over the plan's quota is refused, not billed.

    402 CREDITS_INSUFFICIENT

  5. The bill grows with your free tier

    Per monthly active user pricing charges you for people who have not paid you yet.

    With Rekey

    Logins are not counted or billed, on Rekey Cloud or on your own server.

    no per-MAU meter

  6. Your users live in someone else's database

    You cannot query them, and moving 40,000 of them means 40,000 password resets.

    With Rekey

    Self-host and they live in your own Postgres. Bring existing bcrypt hashes with you: each one is checked and rehashed at first sign-in, so nobody resets a password.

    MIT, source on GitHub
Start free on Rekey CloudRead the quickstart
Create an Application, set up sign-in, mint a key and add a plan, at the speed the panel really runs.

  1. Sign in to the operator panel

    One operator account, one workspace, no install step before this.

  2. Create an Application

    Name, slug, environment. Its own users, keys, auth config and billing.

  3. Mint a server API key

    Shown once, then only a SHA-256 hash is kept.

  4. Configure auth and redirect URLs

    Email + password, magic link, and the callback your app returns to.

  5. Prove it works

    Three SDK calls with the key just minted read everything back.

Watch the full walkthrough or read it step by step with a screenshot of every page.

Your users' agents read their own account

Five read-only tools: get_profile, get_subscription, get_credits, list_licenses, list_my_devices. Scoped to the account that signed in. Off until you enable it per Application.

5 tools · read-only

Your agent runs your workspace

Read your plans, payments, users and webhooks, and change them: create plans, mint keys, cancel subscriptions, invite teammates. Writes need mcp:operator:write and an owner or admin role. A credential without the scope never sees the tool listed.

read and write · scoped

Your own MCP server, with sign-in in front

Point your tools at Rekey's authorization server and check each token with one call: rekey.mcp.introspect(). Sign-in, MFA and revocation come with it.

RFC 7662 introspection
Served today, so a strict client can connect
  • RFC 8414 server metadata, suffix and path-insertion forms
  • RFC 9728 resource metadata, on the 401 too
  • RFC 7591 dynamic client registration
  • PKCE S256 only. plain is rejected
  • RFC 7662 token introspection
Read the MCP guide
Auth11 entries
  • Email + password (argon2id), magic links, and OAuth: Google, GitHub, Microsoft, Discord, GitLab, Slack, any OIDC provider
  • MFA with TOTP and backup codes, each code accepted once
  • Sign-up rules by email domain: allow a list, block a list, refuse throwaway inboxes
  • Refresh-token rotation with reuse detection. A replayed token revokes every session
  • Device-bound sessions, with a max_devices entitlement per plan
  • Sessions revoked one at a time, or everywhere at once
  • Application roles and organization roles, with a custom role catalog per organization
  • Use one Application as an OIDC provider to sign users in to another
  • Import password hashes from a previous system; bcrypt is verified and rehashed on first sign-in
  • JWKS endpoint with opt-in RS256 for offline token checks
  • End-user passkeys are not available yet. Operator accounts have them
Billing10 entries
  • Subscription, License, Usage, and Credit plans
  • Stripe, PayPal, and Razorpay behind one interface, with geographic routing
  • Free trials, one per buyer by default, configurable per plan. Day zero is never charged
  • Free tiers and granted subscriptions with no provider: invoiced sales, comped accounts, migrations
  • Entitlement overrides, so you can sell a deal the plan does not describe
  • Refunds, unapplied-payment detection, and automatic dunning
  • Customer self-service portal, and a revenue dashboard: MRR, churn, 12-month trend
  • A checkout page with your branding, in beta for PayPal, Razorpay and Stripe and off until you turn it on
  • Webhook receipts persisted and replayable from the panel
  • Coupons and discounts are live; proration is planned, not built
Credits, usage & licenses7 entries
  • Meter any unit: model tokens, tool calls, API calls, MB ingested
  • Included quota per plan, enforced. Over the cap returns 402, not an overage bill
  • Credits debit atomically and idempotently; past zero returns 402
  • Credits and quotas pool to an organization, not just one user
  • License keys issued on activation; seats sold reach the licence, and activation is atomic
  • Free-plan credits claimed once per person, not once per checkout
  • Per-user GDPR export, and erasure that scrubs logs and payloads too. Bulk export is planned
Developer experience11 entries
  • Typed SDKs: @rekey.dev/node, /react, /nextjs, /astro, and a CLI with --json everywhere
  • Every error carries code, message, and fix:
  • Idempotency-Key on every money path, so a retry never double-charges
  • Typed webhook catalog with a signature-verification helper, including first sign-in and trial-ending events
  • isNewUser on every sign-in result, so a first-timer can go straight to onboarding
  • Account emails that carry your app's name and branding, and your own templates sent by key through your Resend or SMTP
  • Operator support console: clear a lockout, resend, reset with a reason, sessions, devices, grants
  • Workspace member scopes over seven domains; token lifetimes as settings
  • Bounded log retention with an optional S3 archive
  • Applications promote from staging to production, and disable instead of delete
  • OpenAPI at /docs on every instance; a panel with Cmd+K and audit CSV export

Self-host

The whole stack, on your infrastructure. No feature held back.

Free/ forever
  • One docker compose command: API, panel, portal
  • Unlimited Applications, Tenants, end-users
  • Your Postgres, your Redis, your processor keys
  • Community support on Discord and GitHub
  • MIT licensed

No per-MAU meter. The Postgres is yours.

Read the self-host guide

Cloud Free

Start here

Put your first app into production without a server or a card.

$0/ month
  • One workspace
  • One app in production
  • Development and staging apps to test in
  • An MCP endpoint your agents can connect to
  • No servers, databases or upgrades to look after
  • Answers from the community on Discord and GitHub

Fair use applies, with usage limits based on running cost.

Start free

Cloud Standard

For when more than one app has people depending on it, or a question cannot wait.

$99/ workspace / month
  • Everything in Cloud Free
  • Three apps in production per workspace
  • Direct support by email and Discord
  • Keep your data in your own cloud account (opt-in, enterprise licence)
  • A shared Slack channel if your team works there
  • Cancel any time, nothing is deleted

Built for apps with paying users of their own.

Start free, upgrade later

Cancel any time. You keep direct support to the end of the period you paid for. After that your workspace keeps running, nothing is deleted, no one is signed out, and one click on your account page puts you on the free plan. Payments are non-refundable except where the law requires otherwise.

Yes. Create an account at rekey.dev, pick Cloud Free, and your workspace opens at panel.rekey.dev, already signed in. No card. You get one app in production plus development and staging apps, under fair use with usage limits based on running cost, and answers from the community on Discord and GitHub. Or self-host under MIT with no limits at all.

Spend this month on your product.

Closing balance

Start free on Rekey Cloud with no card, or run the same code on your own server.

Start free on Rekey Cloud

Cloud is free to start and $99 per workspace / month with direct support · self-hosting is free under MIT

Questions before you start? Ask on Discord

Or run it yourselfMIT · free forever
# set the values marked CHANGE_ME
git clone https://github.com/rekey-dev/rekey
cd rekey && cp .env.example .env

docker compose --profile full up -d

api      127.0.0.1:3030
panel    127.0.0.1:3031
portal   127.0.0.1:3050
# plus postgres and valkey on the compose network
Ports bind to loopback. Set BIND_ADDRESS to expose them.Read the self-host guide
Rekey: sign-in and billing for your app, free to start