Self-hosting Rekey: Docker Compose & Dokploy

Rekey is yours to run. The whole stack, the API, the operator panel, and the database that holds your users and revenue, is a handful of containers you bring up wherever you like: a laptop, a single VPS, or a managed platform. No vendor holds your auth or your billing data. This guide takes you from an empty server to a signed-in operator panel two ways: a one-command Docker Compose boot, and a click-through Dokploy deploy.

What you're running

Self-hosted Rekey is four pieces. Two are Rekey's, the API and the operator panel, and two are infrastructure it leans on:

• API (Fastify, port 3030), every auth, billing, and admin endpoint, plus the operator MCP server.
• Operator panel (Next.js, port 3031), the console you sign in to; it talks to the API.
• PostgreSQL, the source of truth for tenants, applications, users, plans, and payments.
• Redis, shared rate-limiting and the outbound-webhook queue. Required at boot.

Option A, Docker Compose

The fastest path. Clone the repo, set your secrets, and bring it up.

git clone https://github.com/rekey-dev/rekey.git
cd rekey
cp .env.example .env

Open .env and set the values the stack refuses to boot without, plus the public URLs. Note the two datastore passwords have to be written twice, compose does not substitute them into DATABASE_URL and REDIS_URL for you:

# Secrets, generate each with: openssl rand -hex 32
JWT_SECRET=...                 # 64 hex chars
ENCRYPTION_KEY=...             # 64 hex chars (encrypts provider credentials)
SUPER_ADMIN_KEY=...            # bootstrap admin credential

# Datastore passwords, pick anything, then paste the SAME value
# into the two URLs below, replacing CHANGE_ME
POSTGRES_PASSWORD=...
REDIS_PASSWORD=...
DATABASE_URL=postgresql://rekey:CHANGE_ME@postgres:5432/rekey?schema=public
REDIS_URL=redis://:CHANGE_ME@redis:6379

# Public origins (what the browser and providers reach)
API_URL=https://api.yourdomain.com
PANEL_URL=https://panel.yourdomain.com
NEXT_PUBLIC_API_URL=https://api.yourdomain.com
CORS_ALLOWED_ORIGINS=https://panel.yourdomain.com

Then bring the whole stack up. The app services live behind a full profile (so a bare docker compose up starts only Postgres + Redis for local dev), so pass it explicitly:

docker compose --profile full up -d

Compose starts Postgres and Redis, the API runs database migrations automatically on boot, then the API and panel come up. When it settles, the API answers on :3030 and the panel on :3031. Put both behind your reverse proxy / TLS (the next section covers this on Dokploy; with raw Compose, terminate TLS at nginx/Caddy/Traefik).

Lock down operator access

Out of the box, anyone who can reach the panel can sign up an operator (admin) account, fine for local dev, not for a private deployment. Two env vars on the API service control the surface:

# Who can create OPERATOR (admin) accounts:
#   open, anyone can self-sign-up (default; local dev only)
#   invite, only via an invite link an existing operator sends
#   closed, nobody self-signs-up
OPERATOR_SIGNUP_MODE=invite

# The operator MCP server, lets your agent read + operate the workspace
# over scoped OAuth. On by default; set false to turn the whole
# /api/v1/tenant/mcp surface off.
OPERATOR_MCP_ENABLED=true

Option B, Dokploy

Dokploy is an open-source, self-hostable PaaS, think a Heroku/Vercel you own. It wraps Docker Compose with a UI for domains, TLS, and env vars, so you get one-click HTTPS without hand-writing nginx.

1. In Dokploy, create a project and add a Compose service pointed at your fork of the Rekey repo (or paste the compose file).
2. Under Environment, set the same variables as the .env above. Generate the secrets with openssl rand -hex 32 and paste them in, Dokploy stores them encrypted.
3. Under Domains, add a domain for the API service (e.g. api.yourdomain.com → container port 3030) and one for the panel (panel.yourdomain.com → 3031). Toggle HTTPS on for each; Dokploy provisions Let's Encrypt certificates automatically.
4. Hit Deploy. Dokploy pulls, builds, runs migrations, and starts the stack. Watch the logs until the API logs server listening.
5. Open https://panel.yourdomain.com and create your first workspace.

First sign-in, the operator panel

The operator panel is your admin console, served by the panel container at https://panel.yourdomain.com (port 3031). It's the same console the hosted plan uses, everything you run day to day lives here: applications and their API keys, auth configuration, plans and coupons, billing providers, end-users, webhooks, team + roles, and the audit log.

Open it and create your first account, on a fresh instance that account becomes the workspace owner. The operator-panel walkthrough picks up exactly here and covers every screen end to end.

Going to production

A short checklist before you put real traffic on it:

• Back up Postgres. It holds everything that matters. Schedule pg_dump (Dokploy has built-in database backups to S3-compatible storage).
• Keep your secrets. Losing ENCRYPTION_KEY means losing every stored provider credential, it can't be recovered.
• Use live provider keys in the billing tab, and make sure the webhook URL the panel shows is your public API origin.
• Set tight CORS_ALLOWED_ORIGINS, only the origins your panel and apps actually use.
• Run more than one API replica if you need HA, Redis is shared, so rate-limits and the webhook queue work across replicas out of the box.

Where to go next:

• How to use the operator panel, the full console walkthrough.
• Documentation, quickstart, concepts, and the full env reference.
• The repository, the compose file, Dockerfiles, and DEPLOY.md.

Prefer not to run it yourself? Rekey Cloud is the same product with us running the infrastructure, $99 per workspace per month.