Zerker released an open-source, self-hosted API gateway for AI agent traffic that authenticates requests, logs usage, and enables charging without ever storing encryption keys — a capability the authors claim no other gateway currently combines.
The software runs as a single Go binary on user hardware, validates callers against the user's own identity provider, and passes authorization tokens upstream without holding private keys, leaving actual on-chain settlement to the user's own facilitator if needed.
What happened
Zerker Labs released an open-source gateway (Apache 2.0, single Go binary) that routes, authenticates, and logs API calls from AI agents without holding cryptographic keys — users run it on their own hardware, point it at their own identity provider (OIDC), and optionally charge for calls via a payment authorization system.
Why it matters
Existing gateways force a trade-off: ContextForge and Lunar allow self-hosting but cannot charge for calls; Cloudflare can charge but cannot be self-hosted; MCPay does both but stores keys in a TypeScript facilitator service. Zerker claims to do all three — self-host, charge, and never hold keys — because the gateway only verifies authorization tokens and forwards them, leaving actual key management to the user's own infrastructure.
What to watch
The gateway enforces OIDC authentication at startup (no bypass or dev shortcut in the binary) and logs every request as an invocation record through six checkpoints in-process. Local development uses a throwaway mock issuer; production integrates with Auth0, Okta, Google, or any existing identity provider. The pricing page itself is gated behind a demo payment authorization (0.00 USDC) to show how the mechanism works.
Ask the AI about this article →
Zerker's positioning rests on a structural distinction: the gateway does not store keys, it only verifies them. When a caller presents a payment authorization, the gateway checks its validity and decides whether to forward the request — but the cryptographic proof itself never enters the gateway's memory. This separation of verification from custody is the claimed differentiator. ContextForge and Lunar, the authors note, self-host but lack a charging mechanism; Cloudflare can charge but is proprietary and cloud-hosted; MCPay combines self-hosting and charging but delegates settlement to a TypeScript service that presumably holds keys on its own hardware. By contrast, Zerker's architecture pushes both the identity provider and the payment facilitator outside the gateway — you run them yourself, you control the keys, and the gateway remains a stateless traffic cop.
The single-binary design (Go, no JVM or Python runtime) and the hard requirement for OIDC at startup (no bypass flag, process exits without it) reflect a deliberate choice to make insecure defaults impossible. Local development gets a mock issuer for convenience; production points at your own identity system. The open-source license (Apache 2.0) and the public comparison against competitors suggest the authors are betting on transparency and self-hosting appeal rather than feature lock-in.
For example, today's edition would include:
AI-summarized, only the topics you pick — one digest a day via Email, Slack, or Discord.
Free · takes 30 seconds · unsubscribe anytimeWhat is AIToday? →
Ask AI anything about this article. Q&As are published on this page for other readers too.
Israeli startup DataAgent Ltd
SK Hynix presented a custom HBM concept at SEMICON Taiwan 2026, where compute functions are placed in the base…
Taoyuan is positioning itself as a northern hub for AI data centers (AIDC), citing the Tatan area and an LNG c…
The U.S. Department of Defense announced on August 31 that it has deployed ChatGPT Mil, a customized version o…
Nvidia reported earnings that were both remarkable and boring, reflecting its focus on avoiding a consolidated…
Anthropic has agreed to a $35bn cloud-computing contract with Lambda, a Nvidia-backed cloud provider
