Unkey
Open-source API key management with edge verification, rate limiting, and usage analytics.
About
Unkey is an open-source developer platform for API authentication: issue, verify, update, reroll, and revoke API keys with metadata, expiration, usage credits, permissions, and RBAC roles — plus standalone rate limiting and per-key analytics. Keys are verified at the edge with sub-millisecond latency through a globally distributed architecture, so adding auth to an API is a single SDK call rather than a homegrown key service. The backend is Go, the dashboard is Next.js, and the project (github.com/unkeyed/unkey) has 5,200+ stars with SDKs for TypeScript, Python, Go, and Rust. Self-host via Docker Compose or use the managed cloud at unkey.com.
The honest caveat: Unkey covers keys, rate limits, and analytics — it is not a full API gateway (no request transformation, no complex routing), so teams needing Kong/Zuplo-style gateway features will outgrow it. The v1-to-v2 API migration renamed things and moved endpoints, so older tutorials may mislead. Self-hosting is real but operationally non-trivial (MySQL, Redis, ClickHouse in the Compose stack).
What it can do
- API key lifecycle: create, verify, rotate, revoke, expire
- Sub-millisecond edge key verification
- Sliding-window, fixed-window, and token-bucket rate limiting
- Per-key metadata, permissions, RBAC roles, and usage analytics
- Temporary keys and remaining-use quotas
Setup
Sign up at unkey.com for managed, or clone github.com/unkeyed/unkey and run the Docker Compose stack. Install the SDK (npm i @unkey/api) and create keys with your root key.
Prerequisites
An API needing key-based auth. For self-hosting: Docker and capacity for MySQL/Redis/ClickHouse.
Use cases
Works with
Trust score — 7/10
Scored 7/10 (metrics tier, metrics-v1). Evidence: Verified via vendor site/docs/GitHub and reputable coverage, wave 46; Trending score 70/100 from researcher assessment.
★ 5,224 GitHub stars
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.