GitHub Repository

Web-scale and security-hardened API key server for users, services, machine to machine, and AI agents. Token derivation brings fine-grained capability tokens to avoid common API key pitfalls. Apache2 open source for indie deployments, commercial for scalable and HA.

93 starsGo

Open-source API Key server written in Go by Ory

Name: Open-source API Key server written in Go by Ory
Availability: InStock
Author: unsubtlecoder

by unsubtlecoder·Jun 11, 2026·6 points·0 comments

Visit Project View on HN

AI Analysis

●●SolidSlickNiche Gem

Token derivation from long-lived keys beats static API key pitfalls.

Strengths

•Side-car deployment mode enables low-latency verification with local caching
•Token derivation for short-lived JWT/macaroons from long-lived keys
•Backed by Ory's existing ecosystem (Kratos, Hydra, Keto)

Weaknesses

•API key management is crowded (Auth0, AWS API Gateway, Kong)
•Commercial license required for HA deployments limits open-source utility

Post Description

Ory Talos (not to confuse with Talos Linux) is an API Key server that bundles security best practices for API keys (ttl, permissions, exchanging short lived tokens, IP allow lists, …) with true webscale (low latency, high throughput) properties. We are excited to show it to the world and hope it makes your engineering life one problem easier!

Happy to answer any questions