What it is

Unkey is a developer platform for modern APIs, written in Go and published as a source-available repository on GitHub. It brings several pieces of API infrastructure into one place: instant API deployment, globally distributed gateways that route and authenticate traffic, API key issuance and verification, ratelimiting, permissions and role-based access control, usage analytics, and audit logs. The project describes itself as unifying infrastructure so that teams can ship faster, and it lives in the security and privacy space, specifically secrets management and API key management, alongside the broader API gateway and authentication ecosystem.

The concrete problem it addresses is the fragmentation that appears once an API reaches production. Issuing and revoking keys, verifying them quickly across regions, enforcing per-key permissions, applying consistent ratelimits, and understanding who called what are usually separate concerns handled by separate tools or by custom code. Unkey consolidates those concerns behind a single platform, so a key can carry permissions and roles, be rate limited by identifier, be verified globally, and leave an immutable audit trail of every action taken across a workspace. Analytics cover usage, latency, and per-key insights across every request, which turns operational questions into queries rather than instrumentation projects.

Key capabilities

• Instant API deployment to production with no infrastructure for the operator to manage.
• Globally distributed gateways that route, authenticate, and shape traffic.
• API key issuance, verification, and revocation with fast global verification.
• Globally consistent and durable ratelimiting for any identifier.
• Per-key permissions, roles, and fine-grained access control through RBAC.
• Analytics covering usage, latency, and per-key insights across every request.
• Immutable audit logs recording every action across a workspace.

Who uses it and how

• Teams exposing public APIs that need key issuance, verification, and revocation without building the key lifecycle themselves.
• Operators routing and authenticating traffic through globally distributed gateways rather than running their own edge layer.
• Services applying ratelimits to arbitrary identifiers, including keys and other caller attributes, with globally consistent results.
• Applications enforcing per-key permissions and roles so that a single key grants only the access it should.
• Teams auditing workspace activity through immutable logs and reviewing per-key usage and latency in analytics.

Getting started

The README points to the hosted platform at unkey.com and to the documentation, and it states that the repository is public and source-available so the code can be read, forked under the terms of the AGPL, and self-hosted. No package manager, Docker image name, or command-line install path is given in the supplied material.

When to use it — and