What's shipped, and what's next.

Password resets, verification links, magic links, the welcome email and the failed payment reminder carry your app's name, and your logo and colour once you set them. A Sender setting holds the From name, a Reply-To address and a support address.

Write a template in the panel, preview it, send yourself a test and publish it, then send it from your backend with rekey.email.send(). It goes out through your own Resend or SMTP account, with typed variables, an idempotency key, and one-click unsubscribe for notification mail.

isNewUser on every sign-in result. Webhooks for a user's sign-ins (with firstSignIn), organization invitations, a trial starting, and a trial ending in three days. A setting for when the welcome email goes out: at sign-up, once verified, or never.

Allow a list of domains, block a list, or refuse disposable inboxes. Existing users keep signing in, and users your team creates or imports are not checked.

A TOTP code, a sign-in challenge or a backup code is accepted once, including when several requests race to spend it. A reused code does not count toward the MFA lockout.

Partial refunds add up and a refund past the payment is refused. A second checkout for a plan that is being paid is refused, so a double click does not make two subscriptions. The free default plan must actually be free.

For PayPal subscriptions only for now. Off by default, switched on per Application and separately for Test and Live. Card details stay in PayPal's window.

Help a customer from their end-user page, restrict a teammate to part of the workspace, decide which emails Rekey sends, import users with their existing password hashes, and sell through a provider Rekey never sees.

Per-caller rate limits stop the panel freezing when you click through tabs quickly. Free trials are sellable again, one per buyer per Application by default.

Every Application is now marked production, staging, or development, and new ones default to development. This replaces the test/live data stamp below: the Application was always the real isolation boundary, every user, subscription, and payment hangs off exactly one, so a separate mode flag on three of those models bought less than it looked like. Key prefixes now follow the app's environment (rp_live_ for production, rp_test_ otherwise) and are no longer chosen at mint time, Environment does not restrict which provider credentials an app may hold, a development app can point at a live processor if that is deliberately what you want to test against. The built-in stub billing providers are gone with it: checkout now fails loudly when no credentials are configured, in every environment including local development.

The operator MCP can now run your workspace, not just read it: create applications, edit auth config, manage plans and webhooks, plus admin tools (configure billing credentials, cancel subscriptions) behind a separate mcp:operator:admin scope. Every tier requires explicit OAuth consent and an OWNER/ADMIN role; the end-user MCP stays read-only.

Rekey's source is now public under the MIT license at github.com/rekey-dev/rekey, self-host from source, audit it, or contribute.

Verify end-user tokens offline, at the edge, in microservices, anywhere, via /.well-known/jwks.json and verifyAccessToken() in @rekey.dev/node. HS256 stays the default; RS256 is per-Application opt-in.

A deployable end-user portal (apps/portal): sign in, view subscription + entitlements, billing history, change plans, cancel at period end.

Failed payments open a recovery case: reminder emails on day 0/3/7 through your app's email transport, auto-cancel with provider sync at day 14, recovery tracked when a later payment lands. Full visibility in the panel.

Shipped, then removed. rp_test_ keys stamped users, subscriptions, and payments, but only those three, so a test user still held real licences, credits, usage, and webhook endpoints. The separation was never as complete as this entry originally claimed. Replaced by per-Application environments, above.

Grant workspace members admin, billing-manager, or viewer access per Application, finance can manage plans and coupons without touching API keys or auth config.

Send an Idempotency-Key header on mutating requests and retry safely, replays return the original response (encrypted at rest), conflicting reuse is rejected.

Per-app MRR/churn/12-month revenue in the panel, one-click DSAR JSON export per end-user, audit-log CSV export, and 17 typed outbound webhook events covering auth, billing, and dunning.

BillingProvider abstraction with BYO credentials per Tenant. Geographic routing across providers is supported.

Plans declare what they bill for. License keys auto-issue on activation of LICENSE plans; USAGE plans bill against tracked meters.

End-user roles scoped per Application with default-role enforcement.

Enrollment via QR; recovery codes downloadable from the panel. Per-Application 2FA policy (off / optional / required) for end-users.

Passkey enrollment and authentication for operator accounts, alongside TOTP. The end-user half is built (routes, storage, SDK helpers) but there is no way to configure the relying party from the panel or the API, so no deployment can switch it on. Treat end-user passkeys as not shipped until that lands.

CREDIT plan kind backed by an atomic, idempotent balance ledger, one-time top-ups that draw down per use.

Verification, password-reset, and magic-link email via BYO or Rekey-managed Resend, with a template editor in the panel.

Percentage/amount coupons with redemption idempotency, plus one-click webhook registration for Stripe/PayPal from the panel.

Google, GitHub, and additional providers behind the same OIDC interface.

Tenants own Workspaces with independent billing config. Operators invite teammates with role assignment.

Typed SDKs + a non-interactive CLI + a read-only MCP server for Claude / Cursor / Claude Code, all live on npm under the @rekey.dev scope.

Full CRUD across plans, coupons, keys, end-users, and workspace settings. Built fresh in Next.js.