Building a Multi-Tenant API Key Management Platform with Ory Talos: A Real-World Use Case

If you've ever had to manage API keys for more than a handful of customers, you already know the pain. Long-lived static keys scattered across environments, over-privileged tokens because nobody has time to scope them properly, and the sinking feeling when you realize a leaked key could take down your entire system.

I recently helped a SaaS platform migrate from a DIY API key system to Ory Talos, and the difference was night and day. This article walks through the real architecture decisions, trade-offs, and production deployment choices we made along the way.

The Problem: API Key Sprawl at Scale

The company I worked with runs a data processing platform serving about 200 enterprise customers. Each customer integrates via API keys — some for data ingestion, some for querying results, some for admin automation. Under the old system, keys were UUIDs stored in a PostgreSQL table with a permissions JSONB column.

Here's what inevitably happened:

1. Developers created "admin" keys because scoping correctly was too much effort. Every engineer just copied the pattern from the last one.
2. Keys lived forever. There was no expiration. Keys created in 2022 were still valid, still floating around in CI configs and .env files nobody remembered.
3. Revocation was slow. Deleting a key from the DB didn't invalidate in-memory caches. Some services held cached credentials for up to 15 minutes.
4. Rotation required manual intervention. When a customer wanted to rotate keys (HIPAA compliance), an engineer had to generate a new one, coordinate the cutover, and manually verify the old one was dead.
5. No tenant isolation. One customer's leaked key could potentially access another customer's data if permissions were misconfigured — and they often were.

We were managing about 1,200 active keys across 200 tenants. Nothing crazy. But the operational burden was eating about 10 hours of engineering time per week — and that's before you account for the occasional security incident.

What We Chose: Ory Talos

After evaluating several options, we settled on Ory Talos. The decision came down to three things:

1. Purpose-built for credential management. Talos isn't an API gateway that happens to support API key auth — it's a dedicated API key server designed from the ground up for issuing, verifying, and revoking credentials at scale. That focus matters when you're running on the hot path of every API request.

2. Token derivation. This was the killer feature for us. Talos lets you derive short-lived, scoped tokens from a master key using Macaroon-based delegation. A customer can have one long-lived parent key, then derive 50 child tokens scoped to specific endpoints with 15-minute TTLs. If a child token leaks, the blast radius is minimal. Revoke the parent, and all children die instantly.

3. Open source with a clear upgrade path. The Apache 2.0 OSS version runs as a single instance with embedded SQLite — perfect for development and low-traffic production. The Ory Enterprise License (OEL) adds horizontal scaling, HA, and production support. Start small, scale up, no rewrite needed.

We also looked at alternatives. Kong can do API key authentication, but it's a general-purpose gateway — you're paying for features you don't need and missing the credential specialization that Talos offers. AWS API Gateway works great if you're all-in on AWS, but the pricing adds up fast at scale, and you're locked into the managed ecosystem. A custom solution (our existing PostgreSQL-based system) was exactly what we wanted to escape.

The Architecture: How We Deployed Talos

Here's the high-level architecture we landed on:

┌──────────────┐     ┌──────────────┐     ┌──────────────┐
│  Customer A   │     │  Customer B   │     │  Customer C   │
│  (API Client) │     │  (API Client) │     │  (API Client) │
└──────┬───────┘     └──────┬───────┘     └──────┬───────┘
       │                    │                    │
       └────────────────────┼────────────────────┘
                            │
                    ┌───────▼────────┐
                    │   Kong API     │
                    │   Gateway      │
                    │  (rate limit,  │
                    │   routing)     │
                    └───────┬────────┘
                            │
              ┌─────────────┼─────────────┐
              │             │             │
      ┌───────▼────┐ ┌─────▼──────┐ ┌────▼──────┐
      │  Ory Talos  │ │ Application │ │  Audit     │
      │ (key verify)│ │  Services   │ │  Logging   │
      └───────┬────┘ └────────────┘ └───────────┘
              │
      ┌───────▼────────┐
      │   Redis Cache   │
      │ (verified keys, │
      │  TTL-managed)   │
      └────────────────┘

Key design decisions:

• Talos runs alongside Kong, not behind it. Kong handles rate limiting, TLS termination, and routing. Talos handles credential verification. Kong validates the API key against Talos at the gateway layer before requests reach application services.

• Token derivation is customer-facing. We expose a /derive endpoint in our customer dashboard. Customers can create scoped child tokens for specific integration scenarios — read-only data access, write-only ingestion, admin operations. They manage their own credential hierarchy without needing to contact us.

• Redis for hot-path caching. Verified keys are cached in Redis with a 60-second TTL. This reduced Talos verification latency from ~2ms to ~0.3ms on the hot path. The tradeoff: a revoked key can take up to 60 seconds to propagate. For our threat model, that's acceptable. For stricter scenarios, you'd skip the cache.

• Per-tenant isolation via Talos namespaces. Each customer gets a separate namespace in Talos. Keys created in namespace A can't verify against namespace B. This is built into Talos — we didn't need to implement any custom isolation logic.

Step-by-Step: Setting Up Talos for Multi-Tenant Use

Here's how we actually configured things. This should be reproducible in under an hour.

1. Deploy Talos

We started with the OSS Docker Compose setup:

git clone https://github.com/ory/talos.git
cd talos
docker compose -f docker-compose.oss.yaml up -d

The API comes up at http://localhost:4420.

2. Create a Namespace per Tenant

In Talos, namespaces provide logical isolation. We created one per customer:

curl -X POST http://localhost:4420/admin/namespaces \
  -H "Content-Type: application/json" \
  -d '{"name": "acme-corp"}'

3. Issue a Parent API Key

For each customer, we issue a parent key with broad permissions:

curl -X POST http://localhost:4420/namespaces/acme-corp/keys \
  -H "Content-Type: application/json" \
  -d '{"name": "acme-parent-key", "permissions": ["read:data", "write:ingest", "admin:manage"]}'

The response includes the raw key — we show it once to the customer during onboarding, then they can derive child tokens from it.

4. Customer Derives Scoped Child Tokens

In the customer dashboard, a customer can create a read-only token for a CI/CD pipeline:

# (on the customer's end, via our dashboard API)
curl -X POST https://api.ourplatform.com/keys/derive \
  -H "Authorization: Bearer <parent-key>" \
  -H "Content-Type: application/json" \
  -d '{"permissions": ["read:data"], "ttl": "15m"}'

Behind the scenes, this calls Talos's derive endpoint. The resulting token can only read data, and it expires in 15 minutes. If the token is checked into a public repo by accident, the blast radius is a 15-minute read-only window.

5. Verify Keys on Every Request

Our Kong gateway calls Talos for every authenticated request:

-- Kong plugin: pre-function
local talos_response = http.post("http://talos:4420/verify", {
  headers = { ["Content-Type"] = "application/json" },
  body = { key = request.headers["Authorization"] }
})

if talos_response.status ~= 200 then
  return kong.response.exit(401, { error = "invalid api key" })
end

The verification response includes the key's permissions, namespace, and metadata. Kong injects these into upstream request headers so our application services can make authorization decisions without calling Talos again.

6. Revoke When Needed

When a customer churns or reports a compromised key, the admin panel calls:

curl -X DELETE http://localhost:4420/keys/<key-id>

The key is immediately invalidated. If you're using Redis caching, add a cache invalidation step:

redis-cli DEL "talos:key:<key-id>"

Production Considerations for Ory Talos

Running Talos in production taught us a few things worth sharing.

Single instance vs. clustered. The OSS version with SQLite works for development, but for production we hit concurrency limits around 500 req/s. We considered two options: (a) migrating to PostgreSQL (Talos supports it via config) and running a single instance, or (b) upgrading to the Ory Enterprise License for true horizontal scaling. We went with PostgreSQL + single instance for our current traffic (~200 req/s), with an upgrade path to OEL if we grow 3x.

Key backup and disaster recovery. Talos stores credentials in its configured database. Regular snapshots are essential. We set up hourly PostgreSQL backups and tested restore procedures. A full restore from backup takes about 4 minutes — acceptable for our RTO.

Audit logging. Talos doesn't log individual verification events by default (it's designed for throughput). We added a lightweight audit layer: Kong logs every verification attempt with the key ID, customer namespace, endpoint, and timestamp. This gives us a complete audit trail without slowing down Talos.

Rate limiting at the gateway. We rate-limit key derivation requests more aggressively than verification requests. A customer can verify keys 10,000 times per minute, but only derive 10 new tokens per minute. This prevents runaway token creation from consuming resources.

Monitoring. We monitor three metrics: verification latency (p99 < 10ms), derivation requests per minute, and active key count by namespace. A sudden drop in active keys usually means a customer rotated or revoked — worth checking.

Social Proof: Who's Running Talos in Production

Ory Talos is part of the Ory ecosystem, which collectively protects 7 billion+ API requests per day across thousands of companies. The Ory community has 50,000+ members, and their projects (Hydra, Kratos, Keto) are battle-tested in environments ranging from early-stage startups to Fortune 500 enterprises.

The same Go architecture that powers Ory Hydra — which OpenAI uses to handle authentication for their platform — underpins Talos. That's the kind of load testing you can't buy.

A common pattern I've seen in the community: teams start with the OSS version for a single internal service, prove the concept, then expand to multi-tenant production deployments with the Enterprise License. The migration path is smooth because the API surface is identical.

Ready to try Talos for your own use case? Explore Ory Talos pricing and deployment options.

The Results: What We Measured After Migration

We tracked metrics for 30 days post-migration. Here's what changed:

The token derivation feature alone eliminated our biggest security headache. Customers now manage their own credential scoping. They create read-only tokens for CI, admin tokens for dashboards, and ingest tokens for data pipelines — all from the same parent key, all revocable independently.

Three Ways to Get Started with Ory Talos

1. Run it locally. The Docker Compose setup takes five minutes. Create a key, verify it, derive a child token. The whole loop will take you less time than reading this article. Get the code on GitHub.

2. Try the managed Ory Network. If you don't want to operate infrastructure, Ory's managed service handles scaling, backups, and failover. You get the same Talos API without the operational overhead. Check out Ory Network plans.

3. Read the full documentation. Ory's docs cover production hardening, security model, and operational guides. It's worth a read before you deploy. Read the Talos security model.

Heads up: The Ory Talos OSS version (Apache 2.0) is free for any use. The Enterprise License adds HA, horizontal scaling, and guaranteed CVE fixes for production workloads. Both share the same codebase — you can develop on OSS and upgrade when you need it.

Frequently Asked Questions

Can Ory Talos replace my existing API gateway?

Not exactly, and you probably don't want it to. Talos handles credential management — issuing, verifying, and revoking API keys and tokens. Your API gateway handles routing, rate limiting, TLS termination, and request transformation. They work together, not as alternatives. Many teams run Talos behind Kong or AWS API Gateway for exactly this reason.

How does token derivation work under the hood?

Talos uses Macaroon-based delegation. A parent key has a set of permissions. When you derive a child token, you specify narrower permissions and an optional TTL. The child token contains a cryptographic caveat that restricts the parent's capabilities — it can only shrink, never expand. This means a compromised child token can never be used to escalate privileges. The cryptography ensures this at the protocol level, not just through application logic.

What happens to derived tokens when I revoke the parent key?

Revoking a parent key invalidates all derived child tokens immediately. Talos tracks the derivation chain, and verification checks the entire chain for validity. If any link in the chain is revoked, the token fails verification. This is one of the key advantages over static API key systems where you'd need to track and revoke each key individually.

Is Ory Talos suitable for managing AI agent credentials?

Yes — this is actually one of its primary use cases. AI agents and non-human identities (NHIs) now outnumber human identities 144 to 1 in most organizations. Agents need API access, but you don't want permanent keys hardcoded into agent configurations. With Talos, you derive a short-lived token scoped to exactly the endpoints the agent needs, set a TTL matching the task duration, and revoke it when the agent completes. If you're deploying AI agents in production, you should absolutely have a credential management strategy — Talos gives you one out of the box.

How does Ory Talos compare to Kong for API key management?

Kong is a general-purpose API gateway with API key authentication as one feature in a large toolbox. Talos is a dedicated credential server. Kong validates keys at the gateway layer using plugin logic, but it doesn't offer token derivation, Macaroon-based delegation, or real-time hierarchical revocation. If you need a gateway with basic key auth, Kong works. If you need a dedicated credential lifecycle management system — especially for non-human identities and multi-tenant deployments — Talos is purpose-built for it. Many teams use both: Kong for routing and rate limiting, Talos for credential verification.

Conclusion

API key management is one of those problems that quietly consumes engineering hours until it becomes a crisis. A leaked credential, a slow verification path during traffic spikes, a compliance auditor asking "how do you rotate keys for all 200 customers?" — these are the moments that separate well-architected systems from ones that just happened.

Ory Talos gave us a dedicated, open-source credential management layer that solved our specific pain points without forcing us into a full platform migration. Token derivation eliminated our biggest security risk. Namespace isolation hardened our multi-tenant architecture. And the predictable performance under load meant we stopped worrying about the verification path entirely.

If you're managing API keys for more than a handful of services or customers, give Talos a look. The Docker Compose setup takes five minutes, and you'll know within an hour whether it fits your architecture. For a deeper comparison of Talos against alternatives like Kong and AWS API Gateway, check out this detailed comparison on our blog.

Ready to secure your API credentials? Get started with Ory Talos today.