What Rekey does, top-to-bottom.
DocumentationRekey is MIT licensed and free to self-host. The SDKs are live on npm under the @rekey.dev scope, and every REST endpoint is documented in the interactive API reference. Need a hand? Talk to the team.
Already know the model? Go straight to the API reference or the SDK reference.
Installlive on npm
# server SDK pnpm add @rekey.dev/node # next.js + react helpers pnpm add @rekey.dev/nextjs @rekey.dev/react # astro pnpm add @rekey.dev/astro # cli + local mcp server, self-host only (needs SUPER_ADMIN_KEY) pnpm add -g @rekey.dev/cli @rekey.dev/mcp
Run the whole stack, then point an app at it
API, Postgres, Redis, the operator panel and the customer portal, on your machine. Nothing to sign up for.
docker compose --profile full upStarter kits
Working apps you can clone. Auth and billing are already wired up, and every integration point is a short file you can read and delete.
- Next.jsAuth and billing: sign-in, sessions, a pricing page fed by live plans, hosted checkout, entitlements and credits.
- AstroThe same, with no JavaScript shipped, on @rekey.dev/astro.
- Digital shopA storefront on Next.js and SQLite. The catalogue is a file; who paid is an entitlement, not a row you keep in sync.
Reference
- QuickstartEmpty directory to a signed-in user in seven steps on the free Cloud plan: two environment variables, the drop-in sign-in form, a protected page. Then a gated feature with no payment provider, and what changes when you self-host.
- ConceptsWorkspace, Application, organization, operator, end user. One sentence each, and how they nest. Workspace and Tenant are the same thing.
- Self-host quickstartBoot the whole stack with one docker compose --profile full up, or deploy on Dokploy with automatic HTTPS. Env vars, public URLs, and a production checklist.
- End-user authEmail + password, OAuth (Google, GitHub, Microsoft, Discord, GitLab, Slack, plus any OIDC provider). MFA with TOTP + backup codes. Refresh-token rotation with reuse detection, role-per-Application, session revocation.
- BillingBillingProvider interface: Stripe, PayPal, and Razorpay behind one schema. Subscription, License, Usage, and Credit plan kinds. BYO credentials per Application, encrypted at rest.
- API keysPublic + secret key pairs per Application. Scoped, rotatable, revocable. Public keys are safe to ship to browsers.
- Transactional emailRegister a template in the panel, publish it, then send it from your backend by key with rekey.email.send({ template, to, variables }). It goes out through your own Resend or SMTP, with every variable checked against the template, safe retries, and one-click unsubscribe on notification mail.
- MCP serverPer-Application MCP server with OAuth 2.1 + PKCE + dynamic client registration, off until you enable it on the Application. End-users authenticate from Claude Desktop / Code / Cursor and the agent reads their own account data.
- WebhooksSigned outbound events Rekey POSTs to your backend: user lifecycle, payments, subscriptions, dunning. HMAC-SHA256 signature, the JSON envelope, verification code, and the full event catalog.
- Error catalogEvery error carries code + message + fix. The fix line tells you what to do, so nobody has to Slack the integration engineer.
SDKs
All published on npm under the @rekey.dev scope. Written in TypeScript, shipped as ESM, typed end-to-end.
@rekey.dev/nodeServer SDK, typed and zero-any. Errors carry fix: lines.@rekey.dev/reactReact hooks + drop-in <SignIn /> / <SignUp /> components.@rekey.dev/nextjsNext.js adapters for App Router middleware and route handlers.@rekey.dev/astroSession handling for Astro: middleware, cookies, and the two rules that are easy to get wrong.@rekey.dev/cliNon-interactive CLI. --json everywhere, money as integers. Self-host only: it calls the admin API with SUPER_ADMIN_KEY.@rekey.dev/mcpLocal stdio MCP server for Claude / Cursor / Claude Code. Eight read tools plus `mint_api_key`. The read tools take SUPER_ADMIN_KEY, so they are self-host only; on Rekey Cloud use the hosted operator MCP (see MCP server above).@rekey.dev/shared-typesZod schemas shared between API and SDKs.
Building with an AI agent?
Point your coding agent at the integration spec: the model rules (org vs user billing, secret vs public keys, server-side entitlements, webhook registration) that prevent the common first mistakes. Also served as plain text at /docs/prompt/raw.
Have a question? Ask the team.