DEV3 Technologies home

DEV3 Tolldeck – Developer API Portal with OpenAPI Docs, Try-it Console, API Keys, Usage Plans & Metering (Next.js)

Developer portal on Next.js 16 and MongoDB: OpenAPI docs, guides and changelog, a try-it console, developer sign-up, apps and API keys, usage plans with rate limits and quotas, gateway or verify-and-report metering and usage invoices. Setup wizard and demo data included. No mobile apps.
by DEV3 TechnologiesVerified Author(0) 0 sales 3 viewsUpdated 11 Nov 2026

Launch Offer: up to 50% off

This item is 50% off: $24.50 instead of $49

Ends in
--
Days
--
Hrs
--
Min
--
Sec

Video tour. Pick a section below to browse 82 screenshots in 6 sections.

App & phone tours

Tap play to watch each app. Nothing downloads until you do.

  • Mobile web0:52

Tolldeck is a developer portal and API metering layer that you host yourself, built by DEV3 Technologies on Next.js 16, React 19, TypeScript, Tailwind 4 and MongoDB. It is for companies that offer an API to outside developers: a weather data API, a shipping-rates API, a payments-adjacent API, an internal platform team. Each provider gets a workspace. In it they publish API products with OpenAPI reference docs, guides and a changelog; developers sign up on the provider's portal, create apps, get API keys and pick a usage plan; traffic is metered and billed per month. You, the operator, sell plans to provider workspaces and watch the platform from an operator panel. The demo shows fictional providers such as a weather API, a freight API and a partner-only ledger API.

No live demo: grouped screenshots and two video tours show the marketing site, the provider console, the developer portal, usage and invoices, and the operator panel. Install it with the demo data to try every role on your own server. This product is a web application with a REST API: there are no mobile apps.

For API providers

  • API products and docs: import OpenAPI 3.0 or 3.1 (Swagger 2.0 is converted best-effort) as JSON or YAML. Versions can be published, deprecated with a sunset date or retired. Reference pages are rendered by Tolldeck itself, with guides and a changelog that flags breaking changes.
  • Usage plans: monthly quotas as hard or soft caps, per-second rate limits with burst, overage per block of units, operation weights, operation allow-lists, trials and approval-required plans.
  • Two metering modes: a gateway that proxies requests to your upstream after checking key, rate limit and quota, or verify-and-report, where your own gateway calls a signed verify endpoint and posts usage batches. Snippets for Express, Laravel, NGINX and FastAPI are included.
  • Dashboard and Toll Lanes: requests by status class, units against plans, top apps, latency percentiles, revenue, and one animated lane per busy app that turns amber and red as quota is used.
  • Developers, apps and keys: approval for partner portals, IP allow-lists, key rotation with a grace period, suspension, quota reset for support and a sampled request log explorer.
  • Usage invoices: base fee, whole overage blocks and tax per line, one invoice per subscription and month, refunds and a grace period before suspension. Payments are simulated until you connect a gateway.

For developers and operators

  • A developer portal per provider with their theme, optional custom domain, pricing, sign-up (open, invite or approval), password or e-mail-link login, apps, keys shown once, rotation, usage against quota, invoices and a try-it console that sends through the gateway with sandbox keys only.
  • Roles (owner, admin, editor, support, analyst), members, audit log, scoped REST API keys with an OpenAPI document and signed outbound webhooks.
  • An operator panel with workspace meters, abuse overview, the e-mail outbox (keys redacted) and audit.
  • Plans, simulated checkout, an installer wizard, demo data and a tolldeck:check command that reconciles usage, rollups, invoices and specs.

What you get

The complete Next.js source with the shared DEV3 core vendored, scripts for scheduled jobs, Documentation/index.html (install, cron, metering modes, SDK snippets, security), START-HERE.txt and LICENSE.txt. Support is included for 6 months.

Good to know

  • Two metering modes. Gateway mode proxies requests to your upstream and suits moderate traffic on one Node process (about 450 requests per second on a developer laptop with the built-in mock upstream; your upstream and hardware decide the real figure). For high volume use verify-and-report mode, where your own gateway verifies keys and reports usage in batches. HTTP and JSON APIs only: no GraphQL federation, gRPC or WebSocket proxying in version 1.
  • Usage invoices come from metered usage; payments are simulated by default and the API provider is the merchant of record. Usage reported through the edge after an invoice has closed is not added to that invoice.
  • MongoDB 6 or newer, one Node process, and cron for key expiry, rollups, dunning and monthly invoicing. Rate limiting and the signature replay cache live in the process; run one process or use verify-and-report mode with a sticky load balancer.
  • APP_SECRET is mandatory outside demo mode and must never change after keys are issued. Back up TOLLDECK_VAULT_KEY: upstream and edge secrets cannot be recovered without it. Private upstream addresses are refused unless you set the install-wide ALLOW_PRIVATE_UPSTREAMS switch.
  • E-mail goes to the outbox until you configure SMTP. Operator billing is simulated by default; run your own sandbox payments first.
  • Name: Tolldeck is a working name checked by a web search only, not a trademark clearance.
  • No hosted demo. All providers, developers and people in the screenshots are fictional.

Quality checks

Tolldeck 1.0.0 passed the seven checks of the DEV3 Next.js suite on the final code: type-checking and linting (0 errors), 794 app tests and 49 core tests (including parallel quota, revoke and rotation races on a real database), a production build of 104 routes with 201.7 KB of gzipped first-load JavaScript and CSS, seeding of the empty and demo datasets, HTTP races against the running server, an install test from the packaged zip and a secret scan.

#developer-portal#api-management#openapi#api-keys#rate-limiting#usage-billing#api-gateway#metering#saas#nextjs#mongodb#api-documentation

How it's built

Architecture, stack, key decisions and the quality gates DEV3 Tolldeck passed before release.

The engineering behind Tolldeck: peppered key hashes with rotation grace, quota checks as one conditional update, a pinned proxy that never follows redirects, idempotent usage batches and invoices that reconcile.

The problem it solves

A metering layer sits on every request an API company serves. A revoked key must stop at once, fifty parallel requests with ten units left must produce exactly ten successes, an upstream that redirects to a private address must never be followed, and a replayed usage batch must not bill twice. The invoice at month end has to equal the plan fee plus whole overage blocks plus tax per line, to the cent.

Architecture and approach

Tolldeck is a Next.js 16 application on MongoDB with a shared DEV3 core for auth, billing and tenancy. Each provider workspace is a tenant: a Mongoose plugin scopes every query by an immutable workspace id and fails closed, and a test enumerates every model.

Keys

Keys are a prefix plus 43 base62 characters, stored as a peppered SHA-256 hash with the last four characters. Unknown, wrong-product and malformed keys return the same error, so the gateway is not an oracle. Rotation claims the old key with one conditional update and records the new key against it with a unique index, so parallel rotations produce one winner. A per-workspace epoch invalidates cached keys on revoke.

Quotas without transactions

A hard cap is a single findOneAndUpdate that increments only while units remain, so the database decides the race. Upstream errors give units back with a conditional decrement. Warnings fire once per period through flags on the period document.

The gateway

Requests stream through an undici agent whose DNS lookup is pinned to the validated address. Redirects are never followed, hop-by-hop and client credentials are stripped, bodies and responses are size capped and timed out, and upstream secrets live in an AES-256-GCM vault.

Usage and invoices

Events are buffered and flushed as guarded increments, so a retried flush changes nothing. Hourly rows roll up to daily rows, and edge batches are idempotent by batch id. Invoices are built from integer minor units with half-up rounding and tax per line, one per subscription and period.

Quality gates and results

The app suite and the core suite pass, together with an HTTP race harness (parallel hard-cap requests, a revoke and a rotation during traffic, duplicate edge batches) and a reconciliation command that checks usage against rollups, invoices and published specs after the demo seed. Known limits: gateway mode is one Node process, the replay cache is per process, and edge usage that arrives after an invoice closes is not billed.

Tech stack

Area Technologies
App Next.js 16, React 19, TypeScript, Tailwind 4
Data MongoDB, Mongoose 9
Security Peppered key hashes, AES-256-GCM vault, HMAC-SHA256, Pinned outbound fetch

Inside the build

Docs, guides and changelog: OpenAPI reference, guides and a changelog with breaking-change badges. Docs, guides and changelog — OpenAPI reference, guides and a changelog with breaking-change badges.

Hero: Open your API and keep the meter running: real docs and the Toll Lanes beside the pitch. Hero — Open your API and keep the meter running: real docs and the Toll Lanes beside the pitch.

Guides & articles

Practical guides and engineering write-ups for DEV3 Tolldeck.

Developer API portal: 7 things to check before you pick one

Last updated
Developer API portal: 7 things to check before you pick one: DEV3 Tolldeck

Developer portals are easy to demo and hard to trust. The questions that matter come after the first key works. Here are seven things to check before you pick a self-hosted portal, with DEV3 Tolldeck as the worked example.

The Tolldeck home page with real reference docs beside the Toll Lanes

1. Are the docs generated from your OpenAPI file?

Import once, keep one source of truth. Check that external references are refused instead of fetched, that Markdown in descriptions is sanitised and that old versions can be deprecated with a sunset date.

The reference docs with the try-it panel

2. How are keys stored?

A portal that can show a developer's key later can leak it. Tolldeck stores a peppered hash and the last four characters, shows the key once, rotates with a grace period and revokes at once.

An app with masked keys

3. What happens at the quota edge?

Fifty parallel requests with ten units left should produce exactly ten successes. Ask how the portal counts without a database transaction, and what happens when the upstream fails.

Plans with quotas, rate limits and overage

4. Gateway or verify-and-report?

A proxy is the simplest to run; your own gateway calling a verify endpoint scales further. Look for both, with the same decisions behind them.

Edge secret and SDK snippets

5. Can you see the traffic?

Usage by product, app and operation, error rates, latency percentiles and a sampled log explorer turn support tickets into a lookup.

The Toll Lanes widget on the dashboard

Video tour of Tolldeck

6. Do the invoices add up?

Base fee, whole overage blocks and tax per line, in integer money, one invoice per subscription and month.

An invoice with overage

7. Who keeps it running?

One Node process and MongoDB, plus cron for rollups and invoicing. Gateway mode suits moderate traffic.

Limits to weigh

HTTP and JSON APIs only: no GraphQL, gRPC or WebSocket proxying. Payments are simulated until you connect a gateway. The replay cache and rate limiter live in the process. Check those against your needs.

Frequently asked questions

The complete source code (version 1.0.0) as a download from your account, with the setup and usage guides shown on this page. You can modify the code to suit your product.

Questions about this product (0)

Answers from the DEV3 team and the community.

Ask a question

No questions yet.

Wondering about setup, licensing or customisation? Ask, and the DEV3 team will help.

Open the product board

More from this author

View all

Related in Enterprise SaaS Starters

View all