Logo
Deploy Now

SaaS Alternative

Auth0

Categories

Developer Tools DevOps Analytics Security Authentication API Management Rate Limiting

Stars

5,421

Forks

633

Watchers

11

Developer links

Last Updated: 08-21-2026 02:30 PM (UTC)

Unkey

Unkey is the open-source platform that unifies API key management, rate limiting, deployment, and observability into a single control plane. The Go API service validates keys with sub-millisecond latency using regional Redis caches and MySQL 8.0 persistent storage, while ClickHouse captures every verification event for per-key and per-keyspace analytics with filterable time-series charts, request counters, and active key tracking. Keyspaces organize API keys by product, environment, or tier, each configurable with custom prefixes, byte lengths, IP whitelists, encrypted key recovery, and delete protection. Per-key settings include expiration dates, rate limit quotas with configurable windows, RBAC roles and permissions, owner identities linking multiple keys to a single user or organization, and key rotation with grace periods from immediate revocation through 24-hour overlap. The deployment pipeline connects GitHub repositories for automatic Docker container builds, generates preview environments per commit, promotes tested versions to production, and validates releases with OpenAPI diff detection flagging breaking changes before production. The edge gateway authenticates and rate-limits requests at the closest region before routing to the nearest API instance. Immutable audit logs track every key creation, verification, deletion, and configuration change with actor, timestamp, and event metadata. The CLI provides terminal access to key management, analytics queries, and deployment operations. On RepoCloud, deploy Unkey on a dedicated VPS with Docker, root SSH access, and complete control over your API infrastructure, all under the AGPL license.

Unkey
Unkey
Unkey
Unkey
Unkey

Benefits

  • Sub-Millisecond Key Verification Globally
  • Regional Redis caches validate API keys with sub-millisecond latency while MySQL stores persistent state, ensuring every verification resolves close to the caller with globally consistent results.
  • Full Deployment Pipeline Built In
  • Git-based Docker container deployments with automatic preview environments per commit, immutable version promotion, instant rollbacks with 30-minute overlap, and OpenAPI breaking change detection before production releases.
  • Granular Per-Key Access Control
  • Each API key supports individual rate limits with configurable windows, RBAC roles and permissions, expiration dates, owner identities linking keys to users, and rotation with grace period options.
  • Complete Observability Without Instrumentation
  • ClickHouse-backed analytics capture every verification event automatically, providing per-key and per-keyspace time-series charts, request counters, status breakdowns, region tags, and filterable audit logs with actor metadata.

Features

  • API Key Management
  • Issue, verify, revoke, and rotate API keys organized in keyspaces with custom prefixes, configurable byte lengths, IP whitelists, encrypted key recovery, and delete protection per keyspace.
  • Global Rate Limiting
  • Globally consistent rate limiting enforced at the edge via Redis 8.0 with configurable per-key, per-IP, and per-identifier quotas, windows, and burst allowances.
  • Git-Based Container Deployments
  • Connect GitHub repositories for automatic Docker container builds with preview environments per commit, production promotion, instant rollbacks, and OpenAPI diff validation.
  • Edge Traffic Gateway
  • Globally distributed gateway authenticates requests, enforces rate limits, validates payloads, and routes traffic to the nearest API instance with multi-region support.
  • Analytics and Audit Logs
  • ClickHouse-powered analytics with per-key verification charts, request counters, and status breakdowns alongside immutable audit logs tracking every workspace action with actor and event metadata.
  • RBAC Permissions System
  • Per-key roles and permissions with fine-grained access control, identity linking for grouping multiple keys under one user or organization, and workspace-level root keys.