Name: Rekey
Brand: Rekey
Availability: InStock

Question 1

What stage is Rekey at?

Accepted Answer

Self-host, the SDKs on npm, and the API are available today, MIT licensed and free with no limits. Rekey Cloud is $99 per workspace per month for one production application, unlimited development and staging. After you subscribe you generate a workspace key on your account page and redeem it at panel.rekey.dev to create the workspace; it takes about a minute and the key is shown as soon as the payment confirms. Want a free trial on our infrastructure first, or enterprise terms? Get in touch and we'll arrange it. The license is settled: MIT.

Question 2

How do I start?

Accepted Answer

Self-host today: run `docker compose --profile full up`, open the panel it boots on your own machine, and add the npm SDKs. The self-host guide walks through the whole thing. For Rekey Cloud, create an account at rekey.dev/sign-up and subscribe.

Question 3

Can I try it without self-hosting?

Accepted Answer

Yes, on Rekey Cloud. We run it and you get a workspace on our infrastructure. Three steps: create an account at rekey.dev/sign-up, subscribe, then generate your workspace key and redeem it at panel.rekey.dev to create the workspace. Ask us first if you would rather have a free trial. Self-hosting is the other route and it's free forever: `docker compose --profile full up` boots the same stack on your own machine.

Question 4

Is this just a wrapper around a payment provider?

Accepted Answer

No. Billing is provider-agnostic: Stripe, PayPal, and Razorpay sit behind one `BillingProvider` interface, set per Application, and you can write your own. You bring the payment processor and keep your own account. Rekey handles the tenant model, the auth-to-billing sync, and the panel; the funds settle in your own processor account.

Question 5

Why multi-tenant from the start?

Accepted Answer

Because most teams ship a second app eventually, and adding tenancy to a single-tenant system later is a long rewrite. A Tenant owns one or more Applications; every row carries `applicationId` and every API call scopes by it. Building it in from line one costs almost nothing.

Question 6

How does the MCP server work?

Accepted Answer

There are two. The end-user MCP is read-only: someone signs in over OAuth 2.1 and their agent gets scoped access to that one account through four tools: `get_profile`, `get_subscription`, `get_credits`, and `list_licenses`. It's off by default; you enable it per Application in the panel. The operator MCP is separate and can also write: 24 tools, 11 read and 13 write, covering metrics, applications, plans, webhook endpoints, members, billing providers, and subscription cancellation. Writes need the `mcp:operator:write` scope and an owner or admin role, and a credential without them doesn't see the tool listed at all. Claude, Claude Code, and Cursor connect to either. No static admin key changes hands.

Question 7

Can I put my own MCP server behind Rekey?

Accepted Answer

Yes. That's a supported path, not a side effect. Your MCP server points clients at Rekey's per-Application authorization server for sign-in, then validates the access token it receives with an RFC 7662 introspection call authenticated by your Application's secret key (`rekey.mcp.introspect()` in the Node SDK). You get sign-in, MFA, and immediate revocation without running an OAuth server. Worth knowing before you build on it: introspection is a call back to Rekey, so these tokens are not verified offline; the scope set is fixed (`openid`, `profile`, `email`, `mcp:account`) rather than something you define; and resource indicators (RFC 8707) aren't implemented, so a token isn't audience-restricted to your server.

Question 8

How do I bill for what an agent actually spends?

Accepted Answer

Two primitives, depending on the shape. Credits are a balance you debit with `POST /api/v1/credits/consume`, atomic and idempotent, and a spend past zero returns `402` instead of going negative. Usage meters are for anything you'd rather count than pre-purchase: define a meter per Application with its own unit, record against it, and if the subscriber's plan carries an included quota, a record that would cross the cap is refused with `402 USAGE_QUOTA_EXCEEDED`. Be clear on what that last one is: a hard cap, checked against the UTC calendar month. Rekey does not currently bill overage. It stops the call rather than charging for it.

Question 9

Which billing providers are live?

Accepted Answer

Stripe, PayPal, and Razorpay, all behind the same `BillingProvider` interface, with geographic routing by country. If you self-host, you can write your own: providers are self-describing modules, and one directory covers checkout, webhook verification, and event mapping, and the registry wires up routes, credential forms, and validation. The how-to lives in docs/billing-providers.md in the repo.

Question 10

Which auth methods are live?

Accepted Answer

Email and password, OAuth (Google, GitHub, Microsoft, Discord, GitLab, Slack, plus any OIDC provider), MFA (TOTP with backup codes), refresh-token rotation with reuse detection, and session revocation. Passkeys are the honest asterisk: the WebAuthn routes, the SDK helpers, and the storage are all built and tested, but there is currently no way to configure the relying party from the panel or the API, so no deployment can actually turn them on. Treat them as not shipped until that lands. SAML and SCIM are planned, not built yet.

Question 11

Who's building this?

Accepted Answer

A small team working on developer infrastructure. Rekey is MIT licensed and the source is at github.com/rekey-dev/rekey, so you can read it before you trust it. The contact form is the fastest way to reach us.

Self-host it for free. $99 a month if we run it for you.

Self-host

Rekey Cloud

Enterprise self-host

Want us to run it for you?

Common questions