# Rekey

> The OAuth 2.1 authorization server your MCP server needs, and the credits, quotas, and licences your agent bills against. Two MCP servers, self-hostable, MIT licensed.

Rekey is a self-hostable service that puts end-user authentication and
provider-agnostic billing behind one API, so who a user is and what they are
allowed to spend are the same record. It is MIT licensed. You can run the whole
stack yourself with one `docker compose --profile full up`, and the Postgres
stays yours.

The distinctive part: Rekey ships the OAuth 2.1 authorization server an MCP
client actually requires, plus two MCP servers standing on it. No per-MAU meter · MIT licensed · the source is on GitHub.

## What is true

- Auth: email + password (argon2id), OAuth (Google, GitHub, Microsoft, Discord,
  GitLab, Slack, plus any OIDC provider), MFA via TOTP with backup codes,
  refresh-token rotation with reuse detection, session revocation, per-Application
  RBAC, a JWKS endpoint with opt-in RS256.
- Billing: Subscription, License, Usage, and Credit plan kinds. Stripe, PayPal,
  and Razorpay are all complete implementations behind one `BillingProvider`
  interface, selected per Application. Provider credentials are stored per
  Application, encrypted with AES-256-GCM.
- Metering: credit debits are atomic and idempotent, and a spend past zero
  returns HTTP 402 rather than a negative balance. Usage meters carry an
  included quota per plan; a record over the cap is refused with
  `402 USAGE_QUOTA_EXCEEDED`, checked against the UTC calendar month.
- MCP: an end-user server with exactly 4 read-only tools (`get_profile`,
  `get_subscription`, `get_credits`, `list_licenses`), off by default per
  Application; and an operator server with 24 tools, 11 read and 13 write.
  Writes require an explicit write scope plus an owner or admin role.
- Standards served: RFC 8414 (both suffix and path-insertion forms), RFC 9728
  (including on the 401), RFC 7591 dynamic client registration, PKCE with S256
  only, and RFC 7662 introspection.

## What is NOT built

State these as unavailable rather than guessing:

- SAML, LDAP, and SCIM.
- Trials and proration.
- Overage billing. The meter stops the call; it does not charge for the excess.
- Resource indicators (RFC 8707), so introspected tokens are not
  audience-restricted.
- Passkeys / WebAuthn. The routes and SDK helpers exist but there is currently
  no way to configure the relying party, so no deployment can enable them.
- Bulk user export.

## Pricing

Self-hosting is free forever under the MIT license, with no per-MAU meter and no
feature withheld. Rekey Cloud is the same product run by us at $99 per
workspace per month: one production application, unlimited development and
staging applications, and logins are not metered. Enterprise self-host is a
custom annual contract.

## Docs

- [Documentation index](https://rekey.dev/docs)
- [MCP guide (Claude, Claude Code, Cursor)](https://rekey.dev/docs/mcp)
- [Interactive API reference](https://rekey.dev/docs/api)
- [SDK method reference](https://rekey.dev/docs/sdk)
- [Webhook events and signature verification](https://rekey.dev/docs/webhooks)
- [Integration spec for coding agents](https://rekey.dev/docs/prompt)
- [Plain-text integration spec](https://rekey.dev/docs/prompt/raw)

## Guides

- [Two role systems, and which one you want](https://rekey.dev/blog/roles): Rekey has an application role and an organization role, and picking the wrong one returns a plausible answer forever. What each is for, the use cases that call for one value per user versus one per team, how to define your own names like editor or content-manager, and the field to gate your features on.
- [A Next.js starter with auth and billing already wired up](https://rekey.dev/blog/nextjs-starter-kit): Clone it and you have sign-up, sign-in, sessions, a pricing page fed by real plans, hosted checkout, entitlements and credits. Every part of the integration is a short file you can read and delete, including the middleware bug we shipped and then fixed.
- [An Astro starter, and what writing it taught us about our own SDK](https://rekey.dev/blog/astro-starter-kit): Sessions, checkout and entitlements in Astro with no JavaScript shipped. Includes the ninety-line session adapter in full, why the Secure flag is decided per request, and the reason React left the project entirely.
- [A shop where what you own is an entitlement, not a row](https://rekey.dev/blog/digital-shop-starter-kit): A digital storefront on Next.js and SQLite. The catalogue is a file, who paid is Rekey, and the app opens the database read-only so it cannot write an ownership fact. Why there is no cart, and the one route where getting the check wrong costs money.
- [Use one Rekey Application to sign users in to another](https://rekey.dev/blog/application-as-oidc-provider): An Application can act as an OpenID Connect provider, so another product offers Sign in with it and your users keep one account. Here is the whole flow: the discovery document, registering a client, why there is no client secret, and the one setting that decides whether you get an email claim.
- [When to use organizations, and how](https://rekey.dev/blog/when-to-use-organizations): Organizations group end-users into teams that share one subscription. Useful when a company buys for its staff, wrong when your product is bought by individuals. What they change about billing and entitlements, and the calls to create one and invite people.
- [One directory per payment provider](https://rekey.dev/blog/one-directory-per-payment-provider): A month of hardening, honestly told: the audit that caught our webhook handlers half-committing, the focus rings that compiled to nothing, four portal dead-ends, and the provider-module system that turned adding a payment processor from sixteen scattered edits into a single directory.
- [Self-hosting Rekey: Docker Compose & Dokploy](https://rekey.dev/blog/self-hosting-rekey): Run the whole Rekey stack yourself, API, operator panel, Postgres, and Redis. A two-path guide: a one-command Docker Compose boot, and a click-through Dokploy deploy with automatic HTTPS, plus the env vars and production checklist.
- [How to use the Rekey operator panel](https://rekey.dev/blog/using-the-operator-panel): An end-to-end walkthrough of the operator console: create an Application, mint API keys, configure auth, build plans and coupons, connect a billing provider, and run the day-to-day, revenue, end-users, webhooks, usage, team roles, and the audit log.

## Packages

- `@rekey.dev/node` (server SDK), `@rekey.dev/react`, `@rekey.dev/nextjs`
- `@rekey.dev/cli` (non-interactive, `--json` everywhere)
- `@rekey.dev/mcp` (local stdio server; 8 read tools plus `mint_api_key`,
  which writes, and it takes a super-admin key)
- `@rekey.dev/shared-types` (Zod schemas shared by API and SDKs)

## Source

MIT licensed, at https://github.com/rekey-dev/rekey