Apikee documentation overview
Learn how Apikee manages API keys, scoped access, developer documentation, and usage analytics with SDKs and a self-hosted platform.
Apikee gives your API the things every API ends up needing — issued keys, scoped access, published docs, usage you can see — without building that platform yourself and without handing your traffic to someone else.
It is MIT licensed, self-hosted, and has no paid tier gating any feature described in these docs.
The shape of it
Two pieces, and they are deliberately unequal in importance:
An SDK in your API. One decorator, middleware or filter. It verifies keys locally, in your process — HMAC signature, scopes and expiry checked on the CPU in about 0.1ms, with no network call on the hot path. If Apikee is down, your API keeps serving.
A platform beside it. A web app where you issue keys, define endpoints and scopes, read request logs, and hand developers a self-service portal. Your infrastructure, your database.
Quickstart
A protected endpoint in about two minutes.
Self-hosting
Docker Compose, one-line installer, or your own orchestrator.
How it fits together
Workspaces, projects, environments, clients, keys.
REST API
Everything the dashboard does, over HTTP.
Pick your SDK
| Language | Install | Frameworks |
|---|---|---|
| Python | pip install apikee | FastAPI · Flask · any ASGI |
| Node.js | npm install apikee | Express · Fastify · Hono |
| Java | dev.apikee:apikee-spring | Spring Boot |
| .NET | dotnet add package Apikee | ASP.NET Core |
All four verify keys the same way and are interchangeable — a key issued for one service verifies in a service written in another language, as long as they share a signing secret.
Two modes
Every SDK runs in one of two modes, and you can start in the first and move to the second without changing your route code.
Local mode needs nothing but a signing secret. Keys are self-contained: the tenant, scopes and expiry are signed into the key itself, so verification is pure CPU. No platform, no database, no network. This is enough for many services.
Server mode adds a serverKey and projectEnv pointing at your Apikee
instance. You keep the same local fast path, and additionally get revocation,
per-key usage logs, IP allow-lists, rate limits and auto-generated docs.
Local mode has zero dependencies. If all you want is signed, scoped, expiring keys, you never have to run the platform at all.
Where things live
| Source | github.com/apikee-dev |
| Container image | ghcr.io/apikee-dev/platform |
| Licence | MIT, every component |