Phase 0.5 · Enterprise hardeningShippedOffline token verification, customer portal, dunning, app environments, team roles
An enterprise-readiness wave: cryptographic and operational features that larger teams ask for first.
- New
Per-Application environments — replacing test/live data isolation
Every Application is now marked production, staging, or development, and new ones default to development. This replaces the test/live data stamp below: the Application was always the real isolation boundary — every user, subscription, and payment hangs off exactly one — so a separate mode flag on three of those models bought less than it looked like. Key prefixes now follow the app's environment (rp_live_ for production, rp_test_ otherwise) and are no longer chosen at mint time, Environment does not restrict which provider credentials an app may hold — a development app can point at a live processor if that is deliberately what you want to test against. The built-in stub billing providers are gone with it: checkout now fails loudly when no credentials are configured, in every environment including local development.
- New
Operator MCP — write + admin tools
The operator MCP can now run your workspace, not just read it: create applications, edit auth config, manage plans and webhooks, plus admin tools (configure billing credentials, cancel subscriptions) behind a separate `mcp:operator:admin` scope. Every tier requires explicit OAuth consent and an OWNER/ADMIN role; the end-user MCP stays read-only.
- New
Open source (MIT)
Rekey's source is now public under the MIT license at github.com/rekey-dev/rekey — self-host from source, audit it, or contribute.
- New
JWKS + opt-in RS256 tokens
Verify end-user tokens offline — at the edge, in microservices, anywhere — via /.well-known/jwks.json and verifyAccessToken() in @rekey.dev/node. HS256 stays the default; RS256 is per-Application opt-in.
- New
Customer self-service billing portal
A deployable end-user portal (apps/portal): sign in, view subscription + entitlements, billing history, change plans, cancel at period end.
- New
Automatic dunning
Failed payments open a recovery case: reminder emails on day 0/3/7 through your app's email transport, auto-cancel with provider sync at day 14, recovery tracked when a later payment lands. Full visibility in the panel.
- Improvement
Test/live data isolation (withdrawn — replaced by environments)
Shipped, then removed. rp_test_ keys stamped users, subscriptions, and payments — but only those three, so a test user still held real licences, credits, usage, and webhook endpoints. The separation was never as complete as this entry originally claimed. Replaced by per-Application environments, above.
- New
Per-application team roles
Grant workspace members admin, billing-manager, or viewer access per Application — finance can manage plans and coupons without touching API keys or auth config.
- New
Idempotency-Key support
Send an Idempotency-Key header on mutating requests and retry safely — replays return the original response (encrypted at rest), conflicting reuse is rejected.
- New
Revenue dashboard, GDPR export, billing webhook events
Per-app MRR/churn/12-month revenue in the panel, one-click DSAR JSON export per end-user, audit-log CSV export, and 17 typed outbound webhook events covering auth, billing, and dunning.