For our first Product Showcase, we're taking a look at Crate (crate.cc), a backend platform designed to bundle edge routing, identity, and secrets management.
What it is
A backend service platform that provides authentication, edge routing, secrets management, and database tooling out of the box.
The Stack
Go microservices, CockroachDB for relational data, ClickHouse for audit logs, and Redis for caching and rate limits.
Why it was built
Starting a new web application often means rebuilding the exact same foundational pieces: wiring up auth, issuing session tokens, provisioning dynamic SSL certificates, handling rate limits, and figuring out how to distribute API keys safely.
Instead of stitching together five separate SaaS services for every new product, Crate bundles those essentials into a single setup that runs identically in local development and production.
The Edge Gateway (crate-gateway)
Everything coming into Crate hits the gateway first. Built directly in Go, it acts as the front door for incoming traffic and handles three specific jobs before any request touches application code:
Automatic TLS & Custom Domains
The gateway handles dynamic ACME certificate provisioning and thread-safe TLS termination for tenant domains and subdomains on the fly.
Admin Isolation
Instead of mixing public and admin routes on the same URL path, administrative APIs live on dedicated subdomains locked down with IP allowlists.
Redis Rate Limiting
Token-bucket limits run at the edge so noisy traffic or scrapers get stopped with a 429 before they ever hit the database.
Identity without the bloat (identity.js)
A lot of modern auth providers require installing huge client SDKs with dozens of dependencies just to show a login prompt. Crate provides a lightweight client that drops into any frontend with a plain script tag:
<script src="https://crate.cc/sdk/v1/identity.js"></script>
A few details about how it works:
- Flexible auth methods: Supports passkeys (WebAuthn), magic links, and standard passwords so applications can choose the auth experience that makes sense for their users.
- Zero dependencies: Pure vanilla JavaScript with no frameworks or bundlers required.
- Drop-in integration: Handles credential creation and assertion ceremonies cleanly against the Crate Identity API.
Secrets & Environment Config
Secret management usually breaks down into either dangerous .env files floating around Slack or complicated enterprise tools that take days to configure.
Crate has its own secrets engine tied into a custom CLI:
- Keys are encrypted at rest with KMS and partitioned by environment (
dev,staging,prod). - In CI/CD (like GitLab CI), runners fetch needed secrets directly into the build environment:
./crate secrets get STRIPE_SECRET_KEY --env prod. - Nobody has to copy-paste production credentials into their local environment files.
Data Layer: CockroachDB & ClickHouse
Instead of trying to run everything out of one database, operational data is split from logs:
- CockroachDB: Stores structured relational data like users, teams, and billing records with distributed ACID transactions.
- ClickHouse: Collects append-only audit events, telemetry, and request history. It handles high-volume writes without slowing down normal application queries.
That's the high-level tour of Crate's architecture. If you're working on something interesting and want to do a technical breakdown for an upcoming showcase, let us know in the Slack channels!