What Rekey does, top-to-bottom.
DocumentationRekey is MIT licensed and free to self-host. The SDKs are live on npm under the @rekey.dev scope, and every REST endpoint is documented in the interactive API reference. Need a hand? Talk to the team.
# server SDK pnpm add @rekey.dev/node # next.js + react helpers pnpm add @rekey.dev/nextjs @rekey.dev/react # cli + mcp server pnpm add -g @rekey.dev/cli @rekey.dev/mcp
Run the whole stack, then point an app at it
API, Postgres, Redis, the operator panel and the customer portal, on your machine. Nothing to sign up for.
docker compose --profile full upStarter kits
Working apps you can clone. Auth and billing are already wired up, and every integration point is a short file you can read and delete.
- Next.jsAuth and billing: sign-in, sessions, a pricing page fed by live plans, hosted checkout, entitlements and credits.
- AstroThe same, with no JavaScript shipped. Includes the session adapter in full, since there is no Astro package yet.
- Digital shopA storefront on Next.js and SQLite. The catalogue is a file; who paid is an entitlement, not a row you keep in sync.
Reference
- Self-host quickstartBoot the whole stack with one docker compose --profile full up, or deploy on Dokploy with automatic HTTPS. Env vars, public URLs, and a production checklist.
- End-user authEmail + password, OAuth (Google, GitHub, Microsoft, Discord, GitLab, Slack, plus any OIDC provider). MFA with TOTP + backup codes. Refresh-token rotation with reuse detection, role-per-Application, session revocation.
- BillingBillingProvider interface: Stripe, PayPal, and Razorpay behind one schema. Subscription, License, Usage, and Credit plan kinds. BYO credentials per Application, encrypted at rest.
- API keysPublic + secret key pairs per Application. Scoped, rotatable, revocable. Public keys are safe to ship to browsers.
- MCP serverPer-Application MCP server with OAuth 2.1 + PKCE + dynamic client registration, off until you enable it on the Application. End-users authenticate from Claude Desktop / Code / Cursor and the agent reads their own account data.
- WebhooksSigned outbound events Rekey POSTs to your backend: user lifecycle, payments, subscriptions, dunning. HMAC-SHA256 signature, the JSON envelope, verification code, and the full event catalog.
- Error catalogEvery error carries code + message + fix. The fix line tells you what to do, so nobody has to Slack the integration engineer.
SDKs
All published on npm under the @rekey.dev scope. Written in TypeScript, shipped as ESM, typed end-to-end.
@rekey.dev/nodeServer SDK, typed and zero-any. Errors carry fix: lines.@rekey.dev/reactReact hooks + drop-in <SignIn /> / <SignUp /> components.@rekey.dev/nextjsNext.js adapters for App Router middleware and route handlers.@rekey.dev/cliNon-interactive CLI. --json everywhere, money as integers.@rekey.dev/mcpLocal stdio MCP server for Claude / Cursor / Claude Code. Eight read tools plus `mint_api_key`; it takes a super-admin key, so treat it as privileged.@rekey.dev/shared-typesZod schemas shared between API and SDKs.
Building with an AI agent?
Point your coding agent at the integration spec: the model rules (org vs user billing, secret vs public keys, server-side entitlements, webhook registration) that prevent the common first mistakes. Also served as plain text at /docs/prompt/raw.