FAQ

Is Keyring a gateway?

No. It is an SDK that runs in your process. Verification makes no network call, so an outage of the control plane does not stop your API verifying keys. It does stop rotations and revocations landing, and it refuses requests that carry Idempotency-Key unless you set that mode to open. In your process, not in front of it.

What happens when the control plane is down?

Every node keeps verifying from its cached policy. The one thing an outage takes by default is idempotency: a request that carries Idempotency-Key is answered 503 until the control plane is back, unless you set that mode to open. What an unknown key does depends on the mode and on the state of the cache, and it is not one number: a complete cache admits nothing until it is stale past maxStalenessMs, while a process that has never loaded a snapshot admits any well-formed key from its first request until its first successful poll. When Keyring is down has the table, state by state; a money route sets onUnavailable: 'closed'.

How fast does a revoke land?

Within one poll, 5 seconds by default, measured between 4.4 and 4.9 seconds. revoke?wait=true returns a receipt once every polling node has acknowledged. Rotate and revoke.

Can I run one deployment for test and live?

That is the shape the docs lead with. A kr_test_ and a kr_live_ key hit the same endpoint and reach different resources. Test mode.

Is test mode free?

Billing counts active tenants per month from live traffic only, in EUR. Test traffic is never counted. The free plan includes 3 tenants. Paid plans are coming and are not open yet, so there is no checkout and nothing charges a card; to join the waitlist, write to hello@keyringdev.com.

Where does my data live?

In the EU, only. There is no US control plane, replica or failover, by architecture.

Can support recover a key?

No. The control plane stores hashes. A key is shown once at mint or rotation and never again, to anyone.

Can I install the packages from npm?

Yes. All eight are published under the MIT license — npm install @keyring-dev/sdk, or the adapter for your framework, on Node 22 or later. Start in 5 minutes. The repository itself stays private.

Does it work on the edge runtime, or in middleware.ts?

No, and it is refused at build time rather than degraded. The cache, the poller and the disk snapshot need a long-lived Node process. Next.js.

Which frameworks?

Express, Fastify, NestJS on either platform adapter, and Next.js App Router on the Node runtime. Anything else uses the plain SDK, which is four calls. Python and Go ports are planned and not yet started; the conformance fixtures they will pass exist today.

Can I see individual requests?

Not yet. Requests and errors per key per day, and per tenant per month, are in the dashboard and the API. Request logs.

Is the SDK MIT licensed?

The eight packages that ship into your process are MIT. The control plane, the dashboard and the hashing pepper are closed.

What does a leaked key do?

Once GitHub's secret scanning delivers a report, a leaked test key or a leaked live secret key (krsk_live_) is revoked at once, and a leaked live API key (kr_live_) is quarantined for an hour, reaching your fleet only once a node polls again — with a mail to the workspace owners either way. Your servers using a revoked krsk_live_ need a new secret key at once. The partner registration that would deliver those reports is not yet done. Key format.