FAQ

Is Keyring a gateway?

No. It is an SDK that runs in your process. There is no network call on the request path, and the control plane's outage is not yours. In your process, not in front of it.

What happens when the control plane is down?

Every node keeps verifying from its cached policy. What an unknown key does depends on the mode and the state of the cache, and the default admits it after 60 seconds of staleness. When Keyring is down has the full table; a money route sets onUnavailable: 'closed'.

How fast does a revoke land?

Within one poll, 5 seconds by default, measured between 4.4 and 4.9 seconds. revoke?wait=true returns a receipt once every polling node has acknowledged. Rotate and revoke.

Can I run one deployment for test and live?

That is the shape the docs lead with. A kr_test_ and a kr_live_ key hit the same endpoint and reach different resources. Test mode.

Is test mode free?

Billing counts active tenants per month from live traffic only. Test traffic is never counted. Nothing charges a card yet; there is no payment integration in the product today.

Where does my data live?

In the EU, only. There is no US control plane, replica or failover, by architecture. The same recipe runs on your own server.

Can support recover a key?

No. The control plane stores hashes. A key is shown once at mint or rotation and never again, to anyone.

Can I install the packages from npm?

Not yet. Build them from the repository and install the tarballs, with an overrides block for the sibling packages. Start in 5 minutes.

Does it work on the edge runtime, or in middleware.ts?

No, and it is refused at build time rather than degraded. The cache, the poller and the disk snapshot need a long-lived Node process. Next.js.

Which frameworks?

Express, Fastify, NestJS on either platform adapter, and Next.js App Router on the Node runtime. Anything else uses the plain SDK, which is four calls. Python and Go ports are planned and not yet started; the conformance fixtures they will pass exist today.

Can I see individual requests?

Not yet. Requests and errors per key per day, and per tenant per month, are in the dashboard and the API. Request logs.

Is the SDK open source?

The eight packages that ship into your process are MIT. The control plane, the dashboard and the hashing pepper are closed.

What does a leaked key do?

Once GitHub's secret scanning delivers a report, a leaked test key is revoked and a leaked live key is quarantined for an hour, with a mail to the workspace owners. The partner registration that would deliver those reports is not yet done. Key format.