Your apps. Your APIs. No keys on the device.
Only the data passes the gate.
Gatekeeper calls credentialed APIs for your apps and websites. The credentials stay on the server, read from Keymaster; callers get the answer and nothing else.
No credentials in apps
Registered clients only
Shared cache, stale fallback
Your app
Gatekeeper
Upstream API
01 Register
Add your apps and websites
Each client gets only the upstreams you grant it. App installs get their own tokens; websites get a key.
02 Connect
Point upstreams at Keymaster secrets
An upstream names the Keymaster secrets it needs. Values are fetched when it is called and never stored here.
03 Serve
Answer from cache when you can
Answers are shared between callers, and the last good one is served, marked stale, if an upstream fails.