FREEDOM251

Freedom251 › Passkey Authentication Software

Locke Gateway

Free plan APISelf-hostedWeb

Visit Locke Gateway Alternatives Pricing

Locke Gateway's own site

What Locke Gateway is

Locke Gateway is a free passkey service that handles WebAuthn registration, authentication, session management, and instant session revocation. A frontend can connect through the open-passkey SDK by selecting the Locke Gateway provider and supplying an RP ID, without setting up a server. The hosted service scopes credentials to RP IDs and checks domains against the HTTP origin; registration and API keys are not required. Its server-backed key-value vault is encrypted in the browser with AES-256-GCM, using a key derived through the WebAuthn PRF extension. Hosted abuse controls include per-IP and per-RP rate limits, request timeouts, and maximum payload enforcement. Client SDKs are listed for React, Vue, Angular, Svelte, SolidJS, and Vanilla JS, alongside server bindings for frameworks including Express, Fastify, Django, Spring Boot, and ASP.NET Core. The service describes hybrid ML-DSA-65-ES256 signatures, with ES256 used today and an automatic upgrade planned when browsers support post-quantum WebAuthn. Domain owners can export credential data after DNS TXT verification. Exported credentials can move to another WebAuthn-compliant relying party, but Gateway sessions do not migrate.

Who it suits

It suits application developers adding WebAuthn passkeys who want a hosted option or a self-hosted backend. The listed SDKs and server bindings cover multiple frontend and server frameworks.

What it does well

  • Free forever with no per-user pricing
  • No authentication rate limits stated
  • Hosted setup needs an RP ID, not a server
  • Browser-encrypted key-value vault
  • Credential export follows DNS TXT verification

What to know first

  • Gateway sessions do not migrate with exported credentials
  • Self-hosting is estimated at about $14/month on AWS

Limits

The free plan is billed Free forever at no cost. The listed plan states no per-user pricing or authentication rate limits, and no other free-tier limits are stated.

Plans

PlanBilled and limitsPrice
Locke GatewayFree forever; no per-user pricing or authentication rate limits. · No free-tier limits statedFree

As lockeidentity.com lists them, read 11 Oct 2026. The maker's own page has the final word.

Getting started

  1. Open the Gateway website
  2. Use the open-passkey SDK
  3. Set the provider to locke-gateway
  4. Supply an RP ID
  5. Choose hosted Gateway or configure a self-hosted baseUrl
  6. Use a listed client or server framework binding

Verdict

Locke Gateway offers hosted passkey authentication with domain scoping, a browser-encrypted vault, and broad framework bindings. Plan for session loss if migrating away, even though credential data can be exported.

Questions

What does Locke Gateway cost?

The Locke Gateway plan is free forever at no cost.

Which platforms does it support?

Platforms are listed as API, self-hosted, and web.

Can credentials be exported?

Yes. After DNS TXT verification of domain ownership, public keys, credential IDs, sign counts, and user handles can be exported.

Do exported passkeys keep Gateway sessions?

No. Credentials can be imported into a WebAuthn-compliant relying party, but Gateway sessions do not transfer.

Is Locke Gateway open source?

Gateway is built on open-passkey, described as an open-source passkey library with six core language implementations.

Facts from Locke Gateway's own pages

Abuse controls
The hosted instance includes per-IP and per-RP rate limiting, request timeouts, and maximum payload enforcement. · lockeidentity.com, 11 Oct 2026
Credential export
After verifying domain ownership with a DNS TXT record, customers can export public keys, credential IDs, sign counts, and user handles for their domain. · lockeidentity.com, 11 Oct 2026
Domain isolation
Credentials are scoped by RP ID, and Gateway validates domains from the HTTP origin without requiring registration or API keys. · lockeidentity.com, 11 Oct 2026
Encrypted storage
Gateway includes a server-backed key-value vault encrypted in the browser with AES-256-GCM using a key derived through the WebAuthn PRF extension. · lockeidentity.com, 11 Oct 2026
Framework support
The page lists client SDKs for React, Vue, Angular, Svelte, SolidJS, and Vanilla JS, plus server bindings for frameworks including Express, Fastify, Django, Spring Boot, and ASP.NET Core. · lockeidentity.com, 11 Oct 2026
Migration limit
Exported credentials can be imported into a WebAuthn-compliant relying party, while users keep their passkeys but not their Gateway sessions when migrating away. · lockeidentity.com, 11 Oct 2026
No server setup
A frontend can use Gateway by setting the open-passkey SDK provider to "locke-gateway" and supplying an RP ID. · lockeidentity.com, 11 Oct 2026
Open-source library
Gateway is built on open-passkey, which the page describes as an open-source passkey library with six core language implementations. · lockeidentity.com, 11 Oct 2026
Passkey authentication
Gateway provides WebAuthn registration, authentication, session management, and instant session revocation. · lockeidentity.com, 11 Oct 2026
Post-quantum readiness
The page describes ML-DSA-65-ES256 hybrid signatures, with ES256 used today and automatic upgrade planned when browsers support post-quantum WebAuthn. · lockeidentity.com, 11 Oct 2026
Self-hosting
The SDK can switch to a self-hosted backend using baseUrl, and the page estimates self-hosting at about $14/month on AWS with Postgres and Redis. · lockeidentity.com, 11 Oct 2026

Where Locke Gateway stands on Freedom251

Look at these too