46ms median · in‑region
API keys without the infrastructure.
Create scoped API keys for your applications. Sub-millisecond verification. Built-in rotation and usage tracking.
Features
Sub-ms verification
Edge checksum validation + KV caching = verification in microseconds, not milliseconds.
Scoped access
Define your own scope vocabulary. Grant explicit permissions per key, no wildcards.
Safe rotation
Rotate keys with a 24-hour grace period. Both old and new keys work during the transition.
Usage tracking
See when and where each key was last used. Track IP and user agent per verification.
API Example
Complete Workflow
# 1. Setup
export SOLENOID_KEY="sm_your_solenoid_key_here"
# 2. Mint a key for one of your users, with your own prefix and scopes
curl -X POST "https://api.solenoid.systems/v1/keys" \
-H "Authorization: Bearer $SOLENOID_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"Acme production","prefix":"myapp_live","scopes":["orders:read"]}'
# Expected response, and the only time the secret is ever returned:
# {"id":"60f06acd-...","secret":"myapp_live_iEjdIkre..._49776023",
# "prefix":"myapp_live","scopes":["orders:read"]}
# 3. Verify it when your user presents it to you
curl -X POST "https://api.solenoid.systems/v1/keys/verify" \
-H "Authorization: Bearer $SOLENOID_KEY" \
-H "Content-Type: application/json" \
-d '{"secret":"myapp_live_iEjdIkre..._49776023"}'
# Expected response:
# {"valid":true,"key_id":"60f06acd-...","owner_id":"usr_...",
# "scopes":["orders:read"]}
# 4. Rotate it with a grace period; both keys work until it expires
curl -X POST "https://api.solenoid.systems/v1/keys/60f06acd-.../rotate" \
-H "Authorization: Bearer $SOLENOID_KEY" \
-H "Content-Type: application/json" \
-d '{"grace_hours":24}'
The keys you mint are your users' credentials, not Solenoid ones. They
authenticate against /v1/keys/verify,
which answers with the scopes you attached, and your own service decides
what those scopes permit.
Comparison
| Solenoid Key | Roll your own | Your cloud's API gateway | |
|---|---|---|---|
| Verification | One HTTPS call, checksum rejected at the edge | A query against your database | Inside that gateway only |
| Scope vocabulary | Yours, defined per key | Yours, and yours to enforce | Usage plans, not scopes |
| Rotation | Built in, with a grace window | Whatever you build | Manual, per key |
| Usage tracking | Last used at, IP, user agent | Whatever you log | Request counts |
| Storage of the secret | Never stored in the clear, returned once | Your problem to get right | Held by the provider |
| What you operate | Nothing | A table, a hash choice, a cache, a rotation story | That gateway, for every service behind it |
| Best for: | Issuing keys to your own users | Teams who want the control and have the time | Traffic already sitting behind it |
Compared on operational surface rather than unit price: any single-purpose free tier undercuts a bundle, and the thing being sold here is not having to wire it up. See /pricing for what it costs.