Unkey

Unkey's REST API has a small, clean surface: /keys.create, /keys.verify, /keys.revoke, /keys.update, /keys.getKey. All endpoints accept JSON and return structured responses. Authentication uses a root key as a bearer token. Keys can have metadata, owner IDs, custom prefixes, expiry, remaining usage counts, and per-key rate limits. The verify endpoint returns detailed status including remaining count and rate limit info. SDK support: TypeScript (first-class), Go, Python (community). REST is fully usable without an SDK.

Key verification responses include a valid boolean, keyId, ownerId, remaining usage, rate limit status, and an optional error code when invalid/expired/rate-limited. Error codes are well-documented (DISABLED, EXPIRED, USAGE_EXCEEDED, etc.). HTTP status codes are standard. Rate limit exceeded returns a structured error with reset time. The API is stateless and fast; no async patterns. Error handling is straightforward for agent consumption.

Unkey is an API key management platform designed for developer tools, making it highly agent-native. An agent can programmatically create, verify, revoke, and set rate limits on API keys for any service using Unkey's backend. This is directly useful for agents that manage access to multi-tenant systems, provision credentials for users, or enforce usage quotas. The API is simple, fast, and well-documented. Open-source (MIT) with a hosted cloud option and self-hosting support. The platform includes key metadata, custom identifiers, remaining usage tracking, and webhook support for key events. Strong fit for agent access-control pipelines.

Root keys are used for API management; generated keys are distributed to end users/agents. Root keys can be scoped to specific permissions (create-only, verify-only, etc.). Key rotation is supported. Unkey is open-source, so auth logic is auditable. The verify endpoint is designed for high-throughput use (low latency, globally distributed). No IP allowlisting documented at the key level. Standard bearer token security model.

Documentation at unkey.dev/docs is comprehensive: getting started guide, API reference, SDK docs, and integration patterns. Examples cover common agent use cases (creating keys for users, verifying on each request, revoking on logout). The open-source nature means source code is available for deep inspection. Community support via Discord. Documentation quality is high for the core API; advanced features (RBAC, analytics) are less detailed.