Locke Gateway

What it does

Abuse controls

The hosted instance includes per-IP and per-RP rate limiting, request timeouts, and maximum payload enforcement.checked 11 Oct 2026

Credential export

After verifying domain ownership with a DNS TXT record, customers can export public keys, credential IDs, sign counts, and user handles for their domain.checked 11 Oct 2026

Domain isolation

Credentials are scoped by RP ID, and Gateway validates domains from the HTTP origin without requiring registration or API keys.checked 11 Oct 2026

Encrypted storage

Gateway includes a server-backed key-value vault encrypted in the browser with AES-256-GCM using a key derived through the WebAuthn PRF extension.checked 11 Oct 2026

Framework support

The page lists client SDKs for React, Vue, Angular, Svelte, SolidJS, and Vanilla JS, plus server bindings for frameworks including Express, Fastify, Django, Spring Boot, and ASP.NET Core.checked 11 Oct 2026

Migration limit

Exported credentials can be imported into a WebAuthn-compliant relying party, while users keep their passkeys but not their Gateway sessions when migrating away.checked 11 Oct 2026

No server setup

A frontend can use Gateway by setting the open-passkey SDK provider to "locke-gateway" and supplying an RP ID.checked 11 Oct 2026

Open-source library

Gateway is built on open-passkey, which the page describes as an open-source passkey library with six core language implementations.checked 11 Oct 2026

Passkey authentication

Gateway provides WebAuthn registration, authentication, session management, and instant session revocation.checked 11 Oct 2026

Post-quantum readiness

The page describes ML-DSA-65-ES256 hybrid signatures, with ES256 used today and automatic upgrade planned when browsers support post-quantum WebAuthn.checked 11 Oct 2026

Self-hosting

The SDK can switch to a self-hosted backend using baseUrl, and the page estimates self-hosting at about $14/month on AWS with Postgres and Redis.checked 11 Oct 2026