Dusklin Gate

A key, write limits and an audit log for every AI-built app

Put Gate in front of your database API. Every AI-built app gets its own key, a list of the calls it may make, a rate limit, and every call lands in an audit log. Ten minutes, no platform team.

How it works

  1. Create a project. Give Gate your API's base URL and, if it needs one, the secret header it expects. You get an admin key, shown once.
  2. Register each app. Name it, list the calls it may make (GET /orders/:id, POST /orders, GET /reports/*) and set its calls per minute. You get that app's key, shown once.
  3. Point the app at Gate. The app sends its own key. Gate checks the key, the call and the limits, adds your upstream secret, forwards the call and writes the audit row.

A call through Gate

curl https://gate.dusklin.com/g/<project-id>/orders/42 \
  -H "Authorization: Bearer <app key>"

Gate answers refused calls itself: 401 for a missing or revoked key, 403 when no rule allows the call, 429 with Retry-After at the per-minute limit, 429 when the month's calls are used up, and 502 when your API does not answer within 30 seconds. The app's key never reaches your API.

Plans

Free

1 project per admin key
3 apps
10,000 calls a month
Audit log kept 30 days

Pro · $29 a month

25 apps
1,000,000 calls a month
Audit log kept 365 days

What we store, and what we never store

We store

Your route rules. The SHA-256 hashes of your keys, never the keys. Call metadata: time, app, method, the route rule the call matched (for example POST /orders/:id), a SHA-256 of the path, status, duration, body size and body SHA-256, and country. When no rule matches, only the path's first segment and its SHA-256. Your upstream secret, encrypted with AES-GCM.

We never store

Request or response bodies. Full request paths. Query string values. Request or response headers. Your users' data in any of those.

Calls without a valid key are counted every hour; the audit log keeps a row for the first 20 of each hour.

Create a project

Or with curl:

curl -X POST https://gate.dusklin.com/api/projects -H "content-type: application/json" \
  -d '{"name":"Shop API","upstream":"https://api.example.com/v1","header_name":"Authorization","header_value":"Bearer ..."}'