Where does the gateway run and who controls the keys?

The gateway runs on your own hardware — on-premises, in your own VPC, or air-gapped — and never holds private keys. It verifies that a caller presents a valid authorization before forwarding the call, but the key itself stays in your own infrastructure, never handed to Zerker.

What identity provider does Zerker support?

The gateway requires an OIDC (OpenID Connect) issuer and audience at startup. In production, it points at any OIDC-compliant provider you already run — Auth0, Okta, Google, or others. Local development uses a throwaway mock issuer booted by `make dev-auth`.

Can I charge for API calls through the gateway?

Yes. The gateway enforces a payment authorization check before forwarding calls and returns a 402 Payment Required response if authorization is absent. The settle server is also open-source and can run on your own hardware; you manage the actual gas key and on-chain settlement yourself.

Large Language ModelsOpen-Source AIAI Business & IndustryHacker NewsAug 7, 2026Aug 8, 2026, 01:01 JST

Zerker AI Gateway: self-hosted agent traffic control, no key custody

Send on LINE

3 Key Points

What happened
Zerker Labs released an open-source gateway (Apache 2.0, single Go binary) that routes, authenticates, and logs API calls from AI agents without holding cryptographic keys — users run it on their own hardware, point it at their own identity provider (OIDC), and optionally charge for calls via a payment authorization system.
Why it matters
Existing gateways force a trade-off: ContextForge and Lunar allow self-hosting but cannot charge for calls; Cloudflare can charge but cannot be self-hosted; MCPay does both but stores keys in a TypeScript facilitator service. Zerker claims to do all three — self-host, charge, and never hold keys — because the gateway only verifies authorization tokens and forwards them, leaving actual key management to the user's own infrastructure.
What to watch
The gateway enforces OIDC authentication at startup (no bypass or dev shortcut in the binary) and logs every request as an invocation record through six checkpoints in-process. Local development uses a throwaway mock issuer; production integrates with Auth0, Okta, Google, or any existing identity provider. The pricing page itself is gated behind a demo payment authorization (0.00 USDC) to show how the mechanism works.

Not sure about something? Ask the AI

Questions and answers are published on this page.

Summaries like this, in your inbox every morning.

Get news like this every morning, free

Context & Analysis

Zerker's positioning rests on a structural distinction: the gateway does not store keys, it only verifies them. When a caller presents a payment authorization, the gateway checks its validity and decides whether to forward the request — but the cryptographic proof itself never enters the gateway's memory. This separation of verification from custody is the claimed differentiator. ContextForge and Lunar, the authors note, self-host but lack a charging mechanism; Cloudflare can charge but is proprietary and cloud-hosted; MCPay combines self-hosting and charging but delegates settlement to a TypeScript service that presumably holds keys on its own hardware. By contrast, Zerker's architecture pushes both the identity provider and the payment facilitator outside the gateway — you run them yourself, you control the keys, and the gateway remains a stateless traffic cop.

The single-binary design (Go, no JVM or Python runtime) and the hard requirement for OIDC at startup (no bypass flag, process exits without it) reflect a deliberate choice to make insecure defaults impossible. Local development gets a mock issuer for convenience; production points at your own identity system. The open-source license (Apache 2.0) and the public comparison against competitors suggest the authors are betting on transparency and self-hosting appeal rather than feature lock-in.

FAQ

Where does the gateway run and who controls the keys?: The gateway runs on your own hardware — on-premises, in your own VPC, or air-gapped — and never holds private keys. It verifies that a caller presents a valid authorization before forwarding the call, but the key itself stays in your own infrastructure, never handed to Zerker.
What identity provider does Zerker support?: The gateway requires an OIDC (OpenID Connect) issuer and audience at startup. In production, it points at any OIDC-compliant provider you already run — Auth0, Okta, Google, or others. Local development uses a throwaway mock issuer booted by `make dev-auth`.
Can I charge for API calls through the gateway?: Yes. The gateway enforces a payment authorization check before forwarding calls and returns a 402 Payment Required response if authorization is absent. The settle server is also open-source and can run on your own hardware; you manage the actual gas key and on-chain settlement yourself.

Hacker NewsRead Original Article

Send on LINE

AI news that matters for your work, delivered every morning.

Pick your industry and the AI tools you use, and get news related to your work every day.

Get it free

Free · 30 seconds with Google · unsubscribe anytimeWhat is AIToday? →

Ask AI

Ask AI anything about this article. The AI reads this article, earlier AIToday articles, and Wikipedia, and cites its sources. Q&As are published on this page for other readers too.