Auth for internal tools in 60 seconds.
Reverse proxy that adds API key auth, session login, rate limiting, and access logs to any service — without touching a line of application code. Set two environment variables. Done.
Running in under 60 seconds.
curl -fsSL https://stockyard.dev/gate/install.sh | sh
GATE_UPSTREAM=http://localhost:3000 GATE_ADMIN_KEY=secret gate Proxy: http://localhost:8780 → http://localhost:3000 Admin API: http://localhost:8780/gate/api
curl -s -X POST http://localhost:8780/gate/api/keys \
-H 'Authorization: Bearer secret' \
-d '{"name":"alice"}'
# Returns sk-gate-... (shown once, save it)
# All requests to :8780 now require the key
curl -H 'Authorization: Bearer sk-gate-...' http://localhost:8780/your/path
Gate proxies every request through an auth check. No key, no access. The dashboard shows live access logs, key management, and user accounts.
Three things developers use this for.
The moment you store users in someone else's cloud, you have accepted their terms, their pricing changes, and their uptime. Gate puts that decision back in your hands.
Deploy Gate as a systemd service, a Docker container, or a bare process. It reads PORT and DATA_DIR. The /api/health endpoint returns status for monitoring.
A consultant keeps Gate running on a home server. Client users stay on local disk, simplifying privacy in every contract.
Free to run. Pro when you need more.
- 1 upstream
- 5 users / API keys
- API key auth (Bearer token)
- Basic session auth (cookie)
- Fixed rate limiting
- Access logs
- Basic admin API
- Embedded SQLite storage
- Unlimited upstreams
- Unlimited users and API keys
- Per-route rate limits
- CORS controls
- Login endpoint (username + password → session)
- Session duration controls
- IP allow / deny lists
- Log filtering and export
- Multiple admin keys
- Route-based protection rules
When Gate is the right tool.
Gate is for auth on internal services where you don't want to stand up Keycloak or write middleware. Free covers 1 upstream and 5 users — enough to protect a single internal tool. Pro ($2.99/mo) unlocks unlimited upstreams, users, per-route rate limits, IP lists, and log export.
Self-hosted auth proxy guide · Gate vs Authelia · Protect internal tools
When you need the full LLM control plane.
Learn about Stockyard →How Pro gets activated.
When your payment goes through, you'll receive an email at the address you used at checkout. The email contains your license key — a string that starts with stockyard_.
Set it as an environment variable before starting Gate:
GATE_LICENSE_KEY=stockyard_your_key_here gate License: Pro (your-email@example.com) Dashboard: http://localhost:8780/ui
That's it. Pro features unlock immediately on startup — no restart required after the first run, no account to log into, no phone-home check. The key is verified locally.
Check your spam folder first. If it's not there after 5 minutes, email hello@stockyard.dev with your payment confirmation and we'll send the key manually.
GATE_CORS_ORIGINS for CORS headers. The POST /gate/login endpoint sets an HTTP-only cookie for browser clients. Pro adds session duration controls.DATA_DIR on shared storage.Add auth to any internal tool in 60 seconds.
Single binary. No code changes required. Free to start.
Part of Stockyard Complete — all 150 tools for $29/mo