Ship your API.We'll handle the keys.
API keys, credits, rate limits, and request analytics for the API you sell — added with one SDK call inside your own middleware. No gateway in front of your traffic.
- 7 official SDKs
- Under 5ms per check
- 100M+ requests validated
Official SDKs with drop-in middleware for the stack you already run
- Python
- Node.js
- Go
- Rust
- PHP
- .NET
- Java
- API requests validated
- 100M+
- Average key validation
- <5ms
- Average analytics ingest
- <5ms
- Check and log, end to end
- <10ms
Months of plumbing, or one call.
Selling access to an API means building a small billing-grade system around it before you ship a single feature. ReqKey is that system, already running.
- Issuing and storing keysPrefixed keys per customer, scoped to the APIs they may call
- Usage quotasA credit balance per customer, charged any amount per call
- Monthly resetsRefills every hour, day, week, or month — reset or top up
- Abuse controlSliding-window rate limits that answer 429 with Retry-After
- Usage logsEvery request, status, and latency logged in under 5ms
- Low-balance warningsShadow limits and email alerts on thresholds you choose
- Revoking a leaked keyDisable or reroll it from the dashboard — no deploy
- Counting across regionsOne balance, synced between regions, never double-counted
- Knowing who changed whatAn audit log with the actor, IP, and a before/after diff
Live in an afternoon. Three steps, one of them code.
ReqKey runs inside your API, not in front of it. Your server asks us one question per request and gets an answer in under 5ms; your traffic never passes through us.
- 1
Create an API and its plans
Name the API you sell, then define plans: how many credits each customer gets, how often they refill, and how fast they may call.
- 2
Give every customer a key
When someone signs up, create a consumer and a key — from the dashboard or one API call. All of a customer’s keys share one balance.
- 3
Add the middleware
Install the SDK and wrap your routes. Every request is checked, charged, and logged before your handler runs.
import express from "express";import { reqkey } from "reqkey/express"; const app = express(); app.use( reqkey({ projectKey: process.env.REQKEY_PROJECT_KEY, apiId: "api_payments", keyName: "x-api-key", excludePaths: ["/health"], }),); app.post("/payments", (req, res) => { // Key checked, 1 credit charged, request logged. res.json({ creditsRemaining: req.reqkey.creditsRemaining });});Every request gets one of these answers
- 200Valid key, credits charged — your handler runs
- 402Out of credits
- 403Key disabled, or not allowed on this API
- 429Over the rate limit — no credits charged
If ReqKey can't be reached
You choose: fail closed and return a 503, or fail open and let traffic through. Invalid keys are denied either way, and a validation is never retried, so no one is charged twice.
Where ReqKey sits
Responses go straight back to your customer. ReqKey sees the key check and the log line, nothing else.
The business side of your API, already built.
Keys, credits, rate limits, and traffic in one dashboard — and every part of it available through the API, so your signup flow can create customers on its own.
A key for every customer, controlled without a deploy
Each customer is a consumer with as many keys as they need — production, staging, a teammate’s laptop. Keys carry your prefix, can be limited to specific APIs, and change state the moment you click.
- Custom prefixes like payments_, scoped to one API or all of them
- Disable, reroll, or delete a key instantly
- Deleted keys stay recoverable for 7 days
Sell usage in credits. Refills run themselves.
Put customers on plans with a credit allowance, a refill schedule, and a rate limit. Charge 1 credit for a search and 40 for a video render — you decide the price of each call.
- Refill hourly, daily, weekly, or monthly — reset or top up
- Shadow limits warn before a balance runs dry
- Optional overage so good customers never hit a wall
- Credits
- 10,000
- Refill
- Every 30 days
- On refill
- Reset
- Rate limit
- 20 / second
- Warn at
- 1,000 left
- /v1/search−1 cr
- /v1/images−5 cr
- /v1/video−40 cr
Stop runaway clients before they cost you
A scraper, a retry loop, a leaked key: rate limits cut them off per customer, in a sliding window you set from one second to one day. Blocked calls answer 429 with Retry-After and cost the customer nothing.
- Per-customer limits, shared across all their keys
- Changes take effect in about 200ms
- Set on a plan or on a single customer
Every request, searchable the moment it lands
Method, endpoint, status, latency, location, and the customer behind it — logged in under 5ms and charted over any window. Go from a spike on the chart to the exact request that caused it.
- Filter by endpoint, customer, method, status, or location
- Open any request to see its headers and body
- Query the same data from the analytics API
And the parts you'd forget until launch day.
Alerts
Email alerts on request volume, error rate, latency, failed validations, or key changes — with cooldowns, so one incident is one email.
Audit log
Every key, consumer, plan, and credit change: who made it, from which IP, and a before/after diff of exactly what changed.
Region sync
Checks run in the region nearest your server. Balances stay in sync between regions, so a customer is never double-counted.
Teams
Invite teammates by email or link as owners, admins, or members. Pro plans have no per-seat fees.
Analytics API
Query stats, time series, breakdowns, and request logs to build a usage page for your own customers.
Set up with your AI assistant
Connect Claude Code, Cursor, or Codex to the ReqKey MCP server and let it wire ReqKey into your codebase for you.
The real dashboard, not a mockup.
What you see after signing up. Everything here can also be done with one API call.
Every customer with their plan, remaining credits, keys, and status — recharge or disable in a click.
Built for anyone who hands out API keys.
Paid APIs
Sell access in plans and credits. Take payment with your own provider; ReqKey keeps the count and enforces it.
AI apps
Give every user a credit balance so one heavy user can’t run up your model bill.
ReqKey for AI appsPartner and internal APIs
Give each partner or service its own key, scope, and limits, and see exactly who calls what.
Free public APIs
Hand out free keys with rate limits, so one scraper can’t take the API down for everyone else.
Pay for requests, not seats.
Start free with 5 million requests a month. Pro tiers run from 10M to 1B requests, with your whole team included.
For side projects and first launches.
Start for free- 5 million free requests every month
- 1,000 API keys
- Unlimited APIs
- Single-member workspace
For APIs in production with real customers.
Start with Pro- 100,000 API keys
- Unlimited consumers, projects & APIs
- Key validations + traffic logs, one meter
- Teams included — no per-seat fees
- 30-day traffic logs · 180-day audit logs
- Analytics API for your own user dashboards
- No hard cutoffs when you cross your plan
Everything in Pro, sized to your traffic.
Contact sales- Everything in Pro
- Volume pricing past 1B requests
- Unlimited projects & APIs
- SLA & custom contracts
- Dedicated support
Need the full tier ladder? Compare every plan
Questions developers ask before they ship.
Something else? Ask the team or read the docs.
No. ReqKey is one SDK call inside your own middleware — no proxy, no DNS change, no gateway. Your responses go straight to your customers; only the key check and the log line reach us.
Key checks average under 5ms from the region nearest your server, and logging the request averages under 5ms too. You set a timeout budget; if it’s exceeded, your failure mode applies instead of the request hanging.
You choose. Fail closed (the default) returns a 503 so nothing slips through unchecked; fail open lets traffic pass so your API never depends on ours. Validations are never retried automatically, so nobody is charged twice.
No. ReqKey meters and enforces usage — credits, limits, and logs. You take payment through your own payment provider and recharge or change a customer’s plan when they pay.
One key validation or one logged API call. Teammates, keys, and APIs don’t add to the count, and no plan rate-limits your own traffic.
You decide what’s captured. Headers, bodies, and client IPs are opt-in, sensitive headers can be excluded, and API keys and credentials are always stripped before anything is logged.
Yes. Connect Claude Code, Cursor, Codex, or any MCP client to the ReqKey MCP server. It can read the docs, create your API and plans, and write the integration — without ever seeing your root key.
Issue your first keyin five minutes.
Free for your first 5 million requests every month. No card, no gateway, no rewrite.