Use cases
Gatekyper is for people who operate more machine identities than they want to trust with permanent provider credentials. Start with one boundary and keep every caller distinct.
Who it is for
The same product model fits different operating scales: protected provider credentials behind the gateway, limited identities in front of it.
Solo builder
Give each project, cron task, CLI, and prototype its own token. See which one used a provider, set a small budget, and retire a project without rotating credentials for everything else.
Useful when one VPS carries several apps and provider accounts.
Agent-heavy developer
Connect agents to the MCP server for usage inspection, denial explanations, and temporary access requests. Keep production and broad scopes behind explicit approval.
Useful for coding, image, research, and background agents with changing tasks.
Small SaaS team
Assign tokens to apps, services, actors, projects, and environments. Apply runtime policy before provider traffic and retain a searchable trail of usage, denials, and administrative changes.
Useful when several services consume paid APIs under one operating team.
Agency
Track provider use by client project, place a budget around each engagement, and revoke finished work independently. Rotate the protected credential without revisiting every client integration.
Useful when teams and automations move between time-bounded client projects.
Operating pattern
Gatekyper turns a broad provider credential into a set of machine identities whose intent is visible and whose access is independently controllable.
Common jobs
A provider key grants whatever the provider grants. A Gate Token can carry the smaller boundary the work actually needs.
Allow one development agent to use chat on selected providers and models, with a short expiration and daily budget.
Approve image generation for a named task, reserve a total spend window, and deny unrelated chat or production access.
Grant allowlisted GitHub repository reads or writes independently so a read-only job never inherits mutation authority.
Give a service a stable token while the provider credential rotates behind it, with rate and budget controls at the gateway.
Attach usage and denials to a client project, then revoke that project’s access when the engagement finishes.
Stop one token, actor, environment, project, or provider route without waiting for a global provider-key rotation.
A clear role
Gatekyper is deliberately narrower than a secret manager, a general API gateway, or a full observability platform.
Protects secret storage and retrieval.
Gatekyper keeps the provider credential out of the caller’s hands while the API is used.
Adds a provider-native boundary.
Gatekyper adds a consistent internal identity, approval, budget, rotation, and kill lifecycle across providers.
Shows what already happened.
Gatekyper can reserve against a hard-stop budget before the request is forwarded.
Real keys in. Scoped tokens out.
Create a separate Gate Token for the next agent, app, or worker you would otherwise give a permanent provider key.
