Already have API keys in production? Migrate them to Unkey without requiring your users to generate new keys.
How migration works#
Export your existing keys
Extract key hashes from your current system (database, auth provider, etc.)
Get a migration ID
Contact us to set up your migration and receive a migrationId
Import to Unkey
Use the migration API to import your key hashes with their configuration
Update your verification
Point your API verification to Unkey, existing keys work immediately
Why key hashes?#
Unkey never stores plaintext keys. During migration, you provide the hash of each key, not the key itself.
Your users continue using their existing keys. When they call your API:
- You extract the key from the request
- Unkey hashes it and matches against stored hashes
- Verification succeeds if there's a match
Result: Zero changes required from your users.
What can be migrated?#
| Setting | Migrated? |
|---|---|
| Key hash | ✅ |
| Custom metadata | ✅ |
| Roles & permissions | ✅ |
| Rate limits | ✅ |
| Credits/remaining | ✅ |
| Expiration | ✅ |
| Identity/owner | ✅ |
Migration paths#
Export hashes from PostgreSQL, MySQL, MongoDB, etc.
Migrate from Auth0, Clerk, Firebase, or custom auth.
Moving from Kong, Tyk, or homegrown solutions.
We'll help you figure out the best approach.
Get started#
Contact us
Email support@unkey.com with: - Your workspace ID - Current key storage system - Approximate number of keys - Hash algorithm used (SHA-256, bcrypt, etc.)
Plan your migration
We'll help you design a migration strategy that minimizes risk.
Execute
Follow our step-by-step guide to migrate your keys.
Every system is different. We're here to help, reach out at support@unkey.com and we'll guide you through your specific migration.