We'll handle keys, credits, rate limits, and analytics.
ReqKey never sits in front of your API. Your code calls reqkey.verify() — we check the key, deduct the credits, and log the request. Your code decides what happens next. Works with Python, Node, Go, Rust, PHP, .NET, and Java — or plain HTTP.
Start integrating free →Official SDKs for seven languages, each with first-class middleware for the frameworks you already use. Install, add your project key, and the validation call drops straight into your request pipeline — no rewrite, no gateway.
Keys, plans, customers, traffic, and audit trails — everything you'd otherwise build around your API, ready on day one. This is the real dashboard, not a mockup.
Each consumer's plan, remaining credits, keys, and status at a glance — with live credit bars and low-credit flags. Recharge, change plans, or disable in seconds.

Define plans like Free Trial, Starter, and Scale — each with credit limits, trials, and automatic renewals. Assign one to a consumer and their credits manage themselves.

Create a key per consumer in one click — or one API call. Scope each key to specific APIs, then suspend, reroll, or revoke it without a deploy. Every change is logged with the consumer, region, and IP.

Method, endpoint, status code, latency, and client IP for every call — ingested in under 5ms and charted as error-rate and latency trends over any time window.


Whether you sell access, gate internal services, or just need to stop abuse — same setup.
Charge for access with plans, credits, and quotas — you set the pricing, we keep the count.
Gate access for customers, partners, or your own internal services from one place.
Rate limits and credit caps cut off scrapers and runaway clients the moment they cross the line.
Every request logged and counted, so usage records are accurate and bugs are traceable.
Failure modes, latency, and what we actually log.
You pick the failure mode. Fail closed (the default) returns a 503 so nothing slips through unpaid; fail open lets traffic pass unvalidated so your API never hard-depends on ours. Both ship with a timeout and an onError hook.
One call to the nearest regional server before your handler — typically single-digit milliseconds. You set the timeout budget; exceed it and your fail mode kicks in instead of hanging.
No. ReqKey is one SDK call inside your own middleware — no proxy, no DNS change, no gateway. Your traffic never leaves your infrastructure except that single validation call.
You decide what's captured. Bodies, headers, and client IP are opt-in, sensitive headers can be excluded, and API keys and credentials are never written to logs.
Instantly, from the dashboard or one API call. Suspend, reroll, or revoke a key with no redeploy — scoped per consumer and per API.
Validation is distributed across multiple regions and built to absorb burst traffic without slowing your API down.
Requests are the only thing we meter — every plan is monthly, and your whole team is included.
One request = one key validation or one logged API call · No rate limits on any plan
See what's includedIssue your first key in five minutes. Free to start.
Start building now