Is Unkey agent-ready?

Unkey scores Band B on The Headless Index. Its JAIRF rating is not available because no machine-readable spec was scored. Its strongest area for agent use is API-first design intent; its weakest is MCP and agent posture.

Does Unkey publish an OpenAPI spec?

No published OpenAPI specification was found when Unkey was scored. That caps its JAIRF dimensions and forces agents to rely on documentation or reverse engineering to operate it.

What is Unkey's Headless Index score?

Unkey scores 60/100 on the Headless Index thesis-fit rubric and sits in Band B in the Auth & Identity category. The score weighs API-first design, headless operation, MCP and agent posture, schema observability, and webhooks.

03 / Scorecard / Auth & Identity

Unkey

Headless Index

60/100

JAIRF

N/A

Verified

AUG 20, 2026

Methodology v1 · JAIRF v1.0.0

Unkey earns Band B in the Auth & Identity category of The Headless Index, with a thesis-fit score of 60/100. Its strongest dimension is API-first design intent (16/20); its weakest scored dimension is MCP and agent posture (6/20). No public OpenAPI specification was found when Unkey was scored, which limits how far an agent can go without human integration work.

Editorial verdict

Unkey is solidly built for programmatic consumption. The Headless Index thesis-fit score of 60/100 lands it in the upper-middle of the index, and JAIRF is recorded as N/A for this vendor because no public OpenAPI specification was reachable for the open-source scorer. In practice, vendors at this tier ship most of the primitives agents need, with one or two surfaces still leaning on documentation rather than discovery, and the rest of this verdict explains where Unkey lands inside that pattern. On the API surface, the question is whether the API is the product or a layer beneath the dashboard. Unkey is an API key management and rate limiting service where the API is the entire product. An agent can drive this product across most practical workflows, with a handful of edges where documentation reading still beats schema discovery. On headless operability: Every primitive is reachable programmatically: minting and revoking keys, attaching metadata and permissions, setting per-key and per-identity limits, and reading audit logs. The dashboard is a thin view over the same endpoints, and the whole server is open source (github.com/unkeyed/unkey), so self-hosting keeps the identical contract. Terraform coverage is community-maintained rather than first-party, which is the one operational gap.^[1] On the MCP and agent-integration axis, which is the fastest-moving criterion in the index: No official MCP server ships under the unkeyed organisation, so an agent that wants to mint or revoke a key calls REST directly or wraps the SDK. The gap costs less here than elsewhere because the surface is narrow and auth is a single root key. Unkey markets itself at agent authentication (per-agent identities, usage-scoped keys), so the product thinking runs ahead of the protocol plumbing.^[2] Event posture closes the loop: an agent that cannot react to state changes is reduced to polling. Events are the weakest part of the surface. Unkey documents no catalogue of signed outbound event types with retry semantics comparable to Stripe or Svix, so a consumer reacting to a revocation or a limit breach polls the analytics and audit log endpoints instead (audit logs are queryable and structured). That covers forensics but not push, and for an agent control plane the absence is a design gap. Net assessment: Unkey can be operated by agents for the majority of practical workflows. The closest thing to a gap is MCP posture^[3], which integrators should sanity-check against their own use case before committing. Strong fit for agent-driven use cases.

Verdict by Headless Index pipeline (auto)

// AI-drafted from the evidence layer. Editorial review pending.

Scores

Scorecard detail

Headless Index · 5 sub-criteria

API-first design intent16/20

scored

Unkey is an API key management and rate limiting service where the API is the entire product. The REST surface (api.unkey.dev) covers keys, APIs, identities, ratelimit namespaces, permissions and roles, and the official clients @unkey/api, @unkey/nextjs, @unkey/hono and @unkey/ratelimit generate against its OpenAPI description. Key verification is one POST returning a structured decision object.

signals (4)

+AI review appliedReviewer: Editorial review on 2026-08-19
−OpenAPI specNot found across 17 probe paths
−GraphQL endpointNot discovered (5 probes; project-scoped endpoints require a real project ID)
·SDKs maintained1 (go); top by stars: unkeyed/best-api (0 stars)

cite (1)

ai_review_browser.auth@2026-08-19

Headless operation16/20

scored

Every primitive is reachable programmatically: minting and revoking keys, attaching metadata and permissions, setting per-key and per-identity limits, and reading audit logs. The dashboard is a thin view over the same endpoints, and the whole server is open source (github.com/unkeyed/unkey), so self-hosting keeps the identical contract. Terraform coverage is community-maintained rather than first-party, which is the one operational gap.

signals (9)

+AI review appliedReviewer: Editorial review on 2026-08-19
−API operations exposedNo OpenAPI spec; operations count unknown
·Docs pages crawled0 pages (crawler: none)
·Auth schemes documentedAuth documentation page not reached by crawler
·Setup / quickstart docsNot reached by crawler
·Billing docsNot reached by crawler
·Teams / org docsNot reached by crawler
·CLI docsNot reached by crawler
·Schema / data model docsNot reached by crawler

cite (1)

ai_review_browser.topics_found@2026-08-19

MCP & agent posture6/20

scored

No official MCP server ships under the unkeyed organisation, so an agent that wants to mint or revoke a key calls REST directly or wraps the SDK. The gap costs less here than elsewhere because the surface is narrow and auth is a single root key. Unkey markets itself at agent authentication (per-agent identities, usage-scoped keys), so the product thinking runs ahead of the protocol plumbing.

signals (4)

+AI review appliedReviewer: Editorial review on 2026-08-19
−Official MCP serverNone found in vendor's GitHub org or the official MCP registry
−Community MCP serversNone found
−Agent-friendly SDKsNo TypeScript/JavaScript SDK published (agents commonly run in TS/JS)

cite (1)

ai_review_browser.pages_fetched@2026-08-19

Schema observability16/20

scored

Unkey publishes a fetchable OpenAPI document for the v2 API (api.unkey.com/openapi.yaml), and that specification generates the official SDKs rather than trailing them. The server implementation is readable at github.com/unkeyed/unkey, so any ambiguity resolves against real handler code. There is no GraphQL surface and none is needed. Analytics endpoints expose verification counts and ratelimit outcomes, letting an agent observe its own consumption.

signals (3)

+AI review appliedReviewer: Editorial review on 2026-08-19
−OpenAPINot discovered across 17 standard probe paths
−GraphQL introspectionNo GraphQL endpoint discovered (5 probes; some vendors use project-scoped endpoints that require a real project handle)

cite (1)

ai_review_browser.pages_fetched@2026-08-19

Webhooks & events6/20

scored

Events are the weakest part of the surface. Unkey documents no catalogue of signed outbound event types with retry semantics comparable to Stripe or Svix, so a consumer reacting to a revocation or a limit breach polls the analytics and audit log endpoints instead (audit logs are queryable and structured). That covers forensics but not push, and for an agent control plane the absence is a design gap.

signals (2)

+AI review appliedReviewer: Editorial review on 2026-08-19
·Webhook docs pageNot reached by crawler within budget (0 pages crawled). Cannot confirm whether vendor offers webhooks.

cite (1)

ai_review_browser.pages_fetched@2026-08-19

JAIRF · 6 dimensions

JAIRF · N/A

This vendor does not publish a public OpenAPI specification. JAIRF cannot be computed. The Headless Index score and editorial verdict carry the readiness assessment.

No public OpenAPI specification discovered during collection

Band rationale:B band: JAIRF=N/A HeadlessIndex=60

04 / Embed

Show Unkey's score on your site.

Drop a live badge into your README, footer, or marketing page. It updates automatically when we re-score, and every embed is a dofollow link back here.

Get embed code

Peers in Auth & Identity

PropelAuthB

Headless Index 60/100

KindeC

Headless Index 58/100

Better AuthB

Headless Index 63/100

See full Auth & Identity ranking →

FAQ

Unkey and agent readiness

Is Unkey agent-ready?: Unkey scores Band B on The Headless Index. Its JAIRF rating is not available because no machine-readable spec was scored. Its strongest area for agent use is API-first design intent; its weakest is MCP and agent posture.
Does Unkey publish an OpenAPI spec?: No published OpenAPI specification was found when Unkey was scored. That caps its JAIRF dimensions and forces agents to rely on documentation or reverse engineering to operate it.
What is Unkey's Headless Index score?: Unkey scores 60/100 on the Headless Index thesis-fit rubric and sits in Band B in the Auth & Identity category. The score weighs API-first design, headless operation, MCP and agent posture, schema observability, and webhooks.