Skip to content
Gatekyper
Self-host Gatekyper
Self-hosted agent access control

Stop giving raw API keys to AI agents.

Keep real provider credentials in your own encrypted vault. Give every app and agent a scoped, budgeted, revocable Gate Token instead.

Self-host Gatekyper See the request path
  • Docker Compose first
  • No payload logging by default
  • Emergency revoke stays local
A protected provider key enters Gatekyper, passes policy and budget checks, and becomes scoped tokens for separate agents.
One access layer across providers
OpenAIAnthropicOpenRouterCloudflare Workers AI · Replicate · GitHub
The raw-key problem

A credential is not an identity.

Once the same master key is copied into an agent, CI secret, worker, and .env file, you lose the ability to answer who can use it, what they can do, and how to stop only one actor.

One broad provider key copied into an environment file, CI secret, AI agent, and VPS worker.
A chart tells you what happened. A policy decides whether it may happen.
Before the requestIdentity, capability, environment, budget, rate, and expiry are checked.
After the decisionUsage and denials are attributed without exposing the provider credential.
The mental model

Real keys in. Scoped tokens out.

One protected upstream credential becomes many controlled internal identities—each with a purpose, owner, scope, budget, and expiration.

A provider vault feeds Gatekyper identity and policy checks, which mediate separate scoped tokens for a canvas agent, coding agent, and worker.
The product

Make least privilege visible.

Gatekyper follows the complete access lifecycle. Every important control is attached to an actor and a stated intent, not hidden in a shared credential.

01

Provider Vault

Add a provider credential once. Encrypt it, version it, test it, rotate it, and never return it.

Encrypted at restVersioned rotationRuntime unlock
02

Gate Tokens

One display-once token per app, agent, worker, feature, tenant, or environment.

03

Spend Guard

Reserve budget before forwarding, then reconcile it against the usage a provider reports.

canvas-agent$1.16 / $3
61% headroom remaining
04

Agent Requests

Let an agent ask for a named capability without letting it mint arbitrary credentials.

05

Runtime Policy

Check the actor, provider, capability, environment, budget, rate, concurrency, and expiry before unlocking the protected key.

IdentityScopeBudgetExpiryAllow
Readable by default

Describe the access intent. Let Gatekyper build the boundary.

Start with a sentence developers can review. Advanced controls remain available without making the safe path feel like writing a firewall rule from scratch.

  • Owner and purpose stay attached to the token
  • Production and write access become obvious risk flags
  • Review shows what changes before approval
Policy templateTemporary agent access
Actor
Capability
Budget
Expiry

canvas-agent may generate images in development for 24 hours, up to $3 total, with no production access.

Deny by default4 explicit boundaries
Runtime enforcement

One request. Seven decisions.

Every request earns its way through the boundary. Unknown models, routes, capabilities, or prices fail closed when hard control is required.

A request passes identity, provider, capability, environment, budget, and expiry checks before Gatekyper forwards it with the protected provider key.

Budgets reserve a conservative amount before a request and reconcile afterward. Provider reporting can introduce a stated tolerance.

Credential lifecycle

Rotate once. Redeploy nothing.

Gate Tokens stay stable while the protected upstream credential changes behind them. Rotate centrally, let old versions drain safely, and preserve one auditable event.

1 provider rotation0 client redeploys
An old provider key is replaced inside the Gatekyper vault while three internal Gate Tokens remain unchanged.
Self-hosted trust

Your infrastructure is the boundary.

Credentials, policy, usage metadata, and emergency controls stay on the host you operate. Gatekyper does not need prompts and responses to enforce access.

Apps and agents present Gate Tokens to Gatekyper inside a private server boundary, which forwards approved calls to API providers.

Self-hosted first

Deploy with Docker Compose on a VPS or private server. The gateway runs separately from the dashboard.

No payload logging by default

Keep policy and usage metadata without retaining prompts, responses, or plaintext Gate Tokens.

Emergency controls stay available

Revoke a token, suspend an actor, freeze an environment, disable a provider, or use a global kill switch.

Read the security model
Docker Compose first

From clone to first protected request.

Follow the whole loop: add a provider credential, issue one Gate Token, make a request, trigger a denial, and inspect the attributed event.

Open the quickstart
terminal
# Start the self-hosted stack
git clone https://git.cameronlow.com/cam/gatekyper.git
cd gatekyper
cp .env.example .env
# Generate the three required values documented in .env
docker compose --profile full up -d --build

# Finish /setup, add a provider, and issue a Gate Token.
# Then point a compatible client at the gateway:
export OPENAI_BASE_URL=http://127.0.0.1:4100/v1
export OPENAI_API_KEY=gk_test_REDACTED
loopback-only Compose stackguided setup continues in /docs/getting-started
Editions, not token taxes

Choose the governance you need.

Community is available for self-hosting. Pro and Team describe the direction for expanded governance and collaboration; they are not yet generally available.

CommunityAvailable

For builders protecting personal projects, apps, and agents on infrastructure they operate.

  • Provider Vault and Gate Tokens
  • Runtime policy, budgets, and rate limits
  • Rotation, revocation, and kill switches
  • Docker Compose deployment
Self-host Community
ProPlanned

A future edition for small teams that need more operational context and workflow support.

  • Everything in Community
  • Expanded approval workflows
  • Operational alerts and integrations
  • Extended audit workflows
View the roadmap
TeamPlanned

A future edition for organizations with broader identity and deployment requirements.

  • Everything planned for Pro
  • Organization access controls
  • Enterprise identity integrations
  • External key-management options
Explore editions

No edition paywalls emergency revoke or core security fixes. No final Pro or Team pricing is published.

Questions before trust

What developers ask first.

Direct answers about the boundary, the request path, and what Gatekyper does not store.

Is Gatekyper a secret manager?

It complements one. Secret managers protect storage and retrieval. Gatekyper keeps the provider credential out of the caller’s hands and enforces policy while the API is used.

Why not use provider project keys?

Use them as defense in depth. Gatekyper adds an internal identity, budget, approval, rotation, and kill lifecycle across providers.

Does Gatekyper store prompts and responses?

Not by default. It can enforce identity, capability, budget, rate, expiry, and usage without retaining payload content.

What happens if the dashboard is down?

The request gateway is a separate service and can remain independently healthy. The UI is not in the provider request path.

Is a hard budget always exact?

Gatekyper reserves conservatively before forwarding and reconciles afterward. When a provider reports cost late, the resulting tolerance should be stated instead of hidden.

Build with agents safely

Give the capability.
Keep the master key.

Real keys in. Scoped tokens out.

Self-host Gatekyper Read the threat model