Duck Galaxy
Galaxy · Open Source

Stop shipping
anonymous AI agents.

Raw API keys have no identity layer. Space Duck gives every agent a birth certificate, a trust tier, and a human who's accountable. It's the missing identity layer for AI infrastructure.

🥚 Hatch your first Duck — free
No credit card · 2 minutes · Self-hostable

Five key advantages

🔐

Zero-Trust Architecture

Every agent call is verified via Peck Protocol before it can act. No implicit trust between services — each request presents a signed beak key and is checked against the birth certificate chain. Unknown agents are lobsters by default.

🪪

Identity-First Design

Every Space Duck has a name, a birth certificate, a trust tier (T0–T2), and a human owner on record. You always know which agent did what — not just which API key was used. Audit logs are first-class, not an afterthought.

🔓

Open Source

The Mighty Space Duck backend is fully open source under MIT. Inspect the auth logic, fork it, self-host it, audit it. No black-box vendor lock-in. The duck flies on infrastructure you control.

💰

Cost-Effective

Free to start on the managed Galaxy. Self-host on AWS with Lambda + DynamoDB + Cognito for pennies per thousand requests. Galaxy 1.2 introduces a transparent paid tier — no surprise overages, no hidden metering.

🔌

Model-Agnostic

Space Duck works with OpenAI, Anthropic, Gemini, LangChain, CrewAI, or any custom HTTP endpoint. Connect your model of choice via The Inlet — one Peck Protocol for every AI surface, regardless of provider.

Space Duck vs Raw API Auth

Capability Raw API Key / Bearer Token 🦆 Space Duck
Agent identity
Is the caller named and traceable?		 ✗ Anonymous key ✓ Birth certificate + display name
Human accountability
Is there a responsible human on record?		 ✗ No ✓ Owner linked at hatch time
Trust tiers
Graduated access levels with upgrade path		 ✗ Flat key scope ✓ T0 → T1 → T2 with Peck Protocol
Audit log
Full action trail per agent		 ✗ Provider-side only ✓ DynamoDB audit trail, your infra
Key rotation
Revoke and reissue without downtime		 ✗ Manual, risky ✓ Beak key rotation via Mission Control
Multi-agent coordination
Agents pecking each other with verified identity		 ✗ Custom-built each time ✓ Peck Protocol built-in
Model agnosticism
Works across AI providers		 ✗ Per-provider keys ✓ Any model via The Inlet
Self-hosting
Full control over your auth stack		 ✗ Vendor-hosted ✓ MIT open source, AWS deploy in ~30 min
Cost to start
Entry cost for a real production agent		 Pay-as-you-go (provider) ✓ Free managed tier
Compliance readiness
Verifiable chain of authority for audits		 ✗ None built-in ✓ Birth cert chain + audit log exportable
🦆 Ready when you are

Your agents deserve an identity.

Hatch a Space Duck in under 2 minutes. Free to start, open source to deploy, designed to scale with your fleet.

🥚 Hatch Your Duck Read the docs →
Free tier · Self-hostable · MIT licence · Galaxy