Guides and updates

Per-topic unsubscribe, scheduled emails you can cancel, cancellation reasons, self-service account deletion and team invites under invite-only sign-up, plus the two behaviour changes to check before you upgrade.

Schedule an onboarding nudge with sendAt, cancel it when the user acts, give it its own unsubscribe topic, and check it in CI with a dry run.

Let signed-in users erase their own account with DELETE /users/me. Choose self_service, server_only or off, confirm with a password or MFA code in the browser or use a secret key on your server, and see what erasure keeps.

Let another product offer Sign in with your app. How the discovery document, PKCE, the ID token, JWKS and the openid, email and profile scopes work, then a working Node relying party and the errors you are likely to hit.

Give an agent or API product a monthly allowance or a credit balance, put the check before the expensive call so a loop cannot overspend, and know exactly what Rekey's record-time lock guarantees when ten runs start at once.

Which hashes come over and what cannot: bcrypt and argon2id import as they are, verified at sign-in, with bcrypt upgraded to argon2id the first time each person signs in. The exact import request, the limits, and a cutover checklist.

The eight calls a strict MCP client actually makes, what Rekey answers at each URL, a tiny server that introspects the bearer token, how scopes and organization binding work, the kill switch, and what is not supported.

A crafted AVIF or SVG could run code inside the Next.js image optimizer that the panel, portal and admin app ship. 2.2.1 moves them to Next.js 15.5.28 and sharp 0.35.5, the API to Fastify 5.12.7 and every image to Node 24.22.1. What was reachable, the exact rebuild steps, and the operator-token and MCP additions that ship with it.

The open roadmap after 2.2.1, for a developer deciding whether to adopt now: refund revocation, reconciliation against the processor, token access to every operator route, pay-first checkout, SAML and SCIM, invoice PDFs and zero-downtime deploys, each with its status and what you do today instead.

What rc.2 to rc.4 let you do: default emails with your name, logo and sender on them, your own templates sent by key, a clean signal for a user's first sign-in, refunds and checkouts that are harder to get wrong, two-factor codes that work once, and an opt-in checkout page with your branding.

Write an order-shipped or invoice-ready email once in the panel, publish it, and send it by key from your backend with rekey.email.send(). Your own provider, typed variables, preview and test send, idempotency, unsubscribe and suppressions, the errors and their fixes, and how the default emails pick up your branding.

Route a first-timer to a setup screen with isNewUser, tell your CRM with the session.created webhook and firstSignIn, pick when the welcome email goes out, remind a trial three days before it ends, and decide which email domains may sign up. With Next.js code and a signed webhook handler.

The first 2.2.0 release candidate, for an operator who already runs Rekey: a support console on the end-user page, tabs that split an account up, devices, restricting a teammate by scope, deciding which emails Rekey sends, importing users with their existing password hashes, and selling through a provider Rekey never sees.

A support walkthrough in the operator panel. Find the person by email, read the tabs that tell a locked account from an unverified one, and use the right remedy: unlock, resend verification, send a reset, reset devices, or sign them out everywhere. Each action records a reason against your operator id.

The panel froze when you switched tabs quickly. One page view cost about a dozen API calls plus twenty-one link prefetches, all against a bucket of 100 per minute that every operator behind your address shared. What changed, the per-caller rate limits and their defaults, the query counts before and after, and why Redis is now Valkey.

Trials are sellable again in 2.2.0, with a limit: one per buyer per Application. Which plan field carries the trial, what the buyer sees at checkout, the 409 that refuses a repeat trialist, how to sell at full price anyway, and the endpoint that lets a pricing page say start your free trial honestly.

Valkey 8.1 replaces Redis on a new, empty volume, three proxy secrets become required, the admin IP allowlist starts refusing addresses it cannot verify, and several migrations lock tables that sign-in depends on. What resets, what to generate, what breaks, and a checklist with the commands.

Rekey has an application role and an organization role, and picking the wrong one returns a plausible answer forever. What each is for, the use cases that call for one value per user versus one per team, how to define your own names like editor or content-manager, and the field to gate your features on.

Clone it and you have sign-up, sign-in, sessions, a pricing page fed by real plans, hosted checkout, entitlements and credits. Every part of the integration is a short file you can read and delete, including the middleware bug we shipped and then fixed.

Sessions, checkout and entitlements in Astro with no JavaScript shipped. Includes the ninety-line session adapter in full, why the Secure flag is decided per request, and the reason React left the project entirely.

A digital storefront on Next.js and SQLite. The catalogue is a file, who paid is Rekey, and the app opens the database read-only so it cannot write an ownership fact. Why there is no cart, and the one route where getting the check wrong costs money.

An Application can act as an OpenID Connect provider, so another product offers Sign in with it and your users keep one account. Here is the whole flow: the discovery document, registering a client, why there is no client secret, and the one setting that decides whether you get an email claim.

Organizations group end-users into teams that share one subscription. Useful when a company buys for its staff, wrong when your product is bought by individuals. What they change about billing and entitlements, and the calls to create one and invite people.

Adding a payment processor used to mean sixteen scattered edits across the API and both UIs. It is now one self-describing directory. Plus the audit behind it, honestly told: webhook handlers caught half-committing, focus rings that compiled to nothing, and four portal dead-ends, all fixed.

Run the whole Rekey stack yourself, API, operator panel, Postgres, and Redis. A two-path guide: a one-command Docker Compose boot, and a click-through Dokploy deploy with automatic HTTPS, plus the env vars and production checklist.

An end-to-end walkthrough of the operator console: create an Application, mint API keys, configure auth, build plans and coupons, connect a billing provider, and run the day-to-day, revenue, end-users, webhooks, usage, team roles, and the audit log.