Skip to main content
API Management issues API keys for your public API and checks them on every request. Your app stays wherever it runs today. API Management can be used alone or alongside Compute. Issue a key with keys.createKey. On each request, your server calls keys.verifyKey, which checks expiry, permissions, rate limits, and credits in one call and returns a single verdict. Unkey stores only a hash of each key. To bring keys you already issued, see Migrating keys.

Get started

Quickstart

Create a keyspace, issue a key, and verify it in a few minutes.

Concepts

Keyspaces, keys, identities, and root keys, and how they fit together.

Keys

Keyspaces

The container for keys: settings, defaults, and listing.

Creating keys

Every keys.createKey field, with bounds and defaults.

Verifying keys

What keys.verifyKey checks, in what order, and what it returns.

Credits and refill

Meter usage per key and refill it daily or monthly.

Control and observe

Rate limiting

Per-key limits, and limits shared across an identity’s keys.

Authorization

Roles, permissions, and the queries keys.verifyKey checks.

Analytics

Query verification and rate limit data with SQL.

Audit logs

See who changed what, and stream it out with a log drain.
Last modified on October 30, 2026