The sign-in for MXT Productions
Sign in once.
Be you everywhere.
GateKey is the one account behind Grraphic, π LIVE and every MXT app. Passkeys, two-factor and every signed-in device in one place — and apps only ever get what they need to know.
- Passkey
- GitHub
- Apple
- Microsoft
- Discord
- Canva
- Slack
- Twitch
- Spotify
- X
Try it — pick a method and sign in
- Face ID / Touch ID confirmed on your device
- Passkey signature verified — no password sent
- Session created · counts as 2FA
- 15-minute token issued to Grraphic
One of you. As many accounts as you need.
Your hub is you. Under it, keep a personal account, a brand, a team — each with its own name and avatar. One password and as many Google (or GitHub, Discord…) logins as you like open all of them. Switch like you switch Google profiles: no signing out, and your two-factor comes with you.
Click an account to switch →
- account_id
- a81d44c0-…
- hub_id
- 3f8c2a1e-… (unchanged)
- mfa_verified
- true (carried over)
- not in the token
Your data, in plain words
When you sign in with Google or another provider, GateKey asks for your name, email address and profile picture — and uses them only to create and protect your GateKey account and sign you in to MXT Productions apps. We don't sell it, we don't advertise with it, and we don't share it with third parties for their own purposes.
The three Google permissions we ask for — switch them off to see what changes
- Signing in never asks for Gmail, Drive, Contacts or Calendar access.
- Any extra access is asked for on the provider's own approval screen, and only when a feature you use needs it.
- Nothing is used for ads, profiling or sold — ever.
GateKey's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Every other sign-in provider is held to the same rules. When you use an MXT feature that works with a linked account — say, a Grraphic tool that lists your GitHub repositories — the app asks GateKey to make that request for you. GateKey makes the call within the permissions you approved on the provider's screen and passes back the result. Your access token itself never leaves GateKey. Email is delivered by Resend; the service runs on our own server on Oracle Cloud. You can revoke GateKey's access at myaccount.google.com/permissions or unlink Google from your dashboard at any time.
Every device you're signed in on. One tap to kick any of them out.
Lost a phone? Revoke it. Changed your password? Every other session ends automatically. Try the Revoke button — that's the real flow.
- Passkeys Face ID, Touch ID, Windows Hello or a security key — phishing-proof, and it counts as two-factor on its own.
- Authenticator apps 6-digit codes from Google Authenticator, 1Password or Authy, plus one-time recovery codes.
- Guessing gets you nowhere Passwords are hashed with argon2id, known-breached passwords are refused, and repeated failures lock the account.
What an app actually gets: this token. That's all of it.
MXT apps get a 15-minute token and check it with one call to GateKey. No email, no passwords, no Google data. Hover over a line to see what each field is for.
$ curl https://gatekey.cc/api/verify \ -H "Authorization: Bearer $TOKEN"
subYour hub — the one ID that means 'you' across every account.