---
title: "Programmable API Management"
description:
  "Developer portals, auth, rate limiting, and full programmability on one
  platform — the same gateway that governs your AI and MCP traffic. Configured
  out of the box, customizable in TypeScript, deployed globally via GitOps."
canonicalUrl: "https://zuplo.com/api-management"
sourceUrl: "https://zuplo.com/api-management"
pageType: "product"
generatedAt: "2026-07-28"
---

# Programmable API Management

> Stop stitching together a gateway, a portal, auth, and analytics. Everything
> it takes to run an API in production on one platform — programmable in
> TypeScript when the defaults don't fit, and now running your AI and MCP
> traffic too.

## Everything you need to manage APIs at scale

Authentication, rate limiting, developer portals, MCP servers, and full
programmability — in one platform.

- **Programmable** — Never limited by your gateway's config. Configure the
  standard policies without code. When defaults don't fit, TypeScript is the
  escape hatch — not the starting point.
  ([/features/programmable](/features/programmable))
- **Dev Portal** — Developer portals that don't suck. Customers subscribe,
  manage keys, and see usage — always in sync with your API.
  ([/features/developer-portal](/features/developer-portal))
- **MCP Server** — Turn your API into an MCP server. Your OpenAPI spec becomes
  MCP tools that agents can discover and call safely. Related:
  [AI Gateway](/ai-gateway), [MCP Gateway](/mcp-gateway).
  ([/features/mcp-servers](/features/mcp-servers))
- **Rate Limit** — Rate limiting, your way. Throttle by endpoint, key, user, or
  any condition — simple limits now, programmable logic when you need it.
  ([/features/rate-limiting](/features/rate-limiting))
- **Authentication** — Authentication, without the pain. Every auth method,
  production-grade out of the box — and secret scanning catches leaks before
  they ship. ([/features/authentication](/features/authentication))
- **Open API** — One standard through the lifecycle. Built on OpenAPI, shipped
  via git commit — governance that doesn't slow teams down.
  ([/features/open-api](/features/open-api))

## When presets aren't enough, drop into code

Every policy is just a TypeScript function — customize it, ship it via git.
Here's role-based access in practice.

```ts
// custom-rbac-policy.ts
export default async function policy(
  request: ZuploRequest,
  context: ZuploContext,
  options: { role: string },
) {
  if (request.user.data.roles.includes(options.role)) {
    return request;
  }
  return new Response("User does not have the correct permissions", {
    status: 403,
  });
}
```

Other examples of programmable policies on the platform:

**Custom Quotas** — apply usage limits on more than just requests. Set quotas
using custom metrics like tokens or compute units from headers.

```ts
export default async function policy(
  request: ZuploRequest,
  context: ZuploContext,
  options: { tokensPerDay: number },
) {
  const tokensUsed = Number(request.headers.get("x-tokens-used") ?? 0);
  const limit = await context.quota.consume(
    `tokens:${request.user.sub}`,
    tokensUsed,
    { perDay: options.tokensPerDay },
  );
  if (!limit.allowed) {
    return new Response("Token quota exceeded", { status: 429 });
  }
  return request;
}
```

**Dynamic Rate Limiting** — limit traffic based on dynamic conditions. Inspect
request payloads, plan tiers, or any custom logic to compute per-user buckets.

```ts
export default async function policy(
  request: ZuploRequest,
  context: ZuploContext,
) {
  const tier = request.user.data.plan ?? "free";
  const limits = { free: 10, pro: 100, enterprise: 1000 };
  return rateLimitPolicy(request, context, {
    requestsAllowed: limits[tier],
    timeWindowMinutes: 1,
    rateLimitBy: "user",
  });
}
```

Need a hand writing your first policy? Spend 30 minutes with a Zuplo architect —
they'll map your APIs and sketch the policy you need, in TypeScript. (Request a
meeting via the "Request a meeting" form on this page.)

## FAQ

**What is API management and why does it matter?** API management is the
practice of designing, securing, deploying, and observing APIs at scale. It
covers authentication, rate limiting, developer portals, monetization,
analytics, and lifecycle governance. Zuplo handles all of this on a single
programmable platform — so your APIs ship faster and stay reliable as they grow.

**How is Zuplo different from legacy API management platforms?** Legacy
platforms like Apigee, Mulesoft, or Azure API Management rely on XML workflows,
GUI-driven configuration, or proprietary DSLs. Zuplo lets you write real
TypeScript for any policy or transformation, deploy via GitOps, and version
everything with git. You get unlimited extensibility without locking yourself
into a vendor's expression language.

**Can I use my existing OpenAPI specs?** Yes — OpenAPI is Zuplo's source of
truth. Drop in your spec and Zuplo generates routes, validates requests, drives
the developer portal, and powers your MCP server. Update the spec via a git
commit and Zuplo's deployment pipeline takes care of the rest.

**How does authentication work in Zuplo?** Zuplo ships first-class policies for
API keys, JWT, OAuth 2.0, Basic Auth, mTLS, and secure tunnels. API keys are
managed through a self-serve portal with built-in rotation, scoping, and GitHub
secret scanning that catches leaks before they reach production. You can also
write a custom auth policy in TypeScript for any non-standard scheme.

**Where does Zuplo run?** Zuplo deploys to 300+ edge locations globally. You can
also run Zuplo as Managed Dedicated on AWS, Azure, GCP, Akamai, or Equinix, or
self-host in your own Kubernetes cluster. The same TypeScript policies, OpenAPI
specs, and GitOps workflow apply across every deployment target.

**Can I monetize my APIs with Zuplo?** Yes. Zuplo includes built-in monetization
that lets you offer tiered pricing, usage-based billing, and self-serve
subscriptions directly from your developer portal — no separate billing system
to maintain. Combine it with custom quotas for fine-grained per-tier metering.

## Next steps

- Start for free: https://portal.zuplo.com/signup
- Talk to an API expert:
  [/schedule-call?utm_content=hero-api-management](/schedule-call?utm_content=hero-api-management)
- Explore individual features: [/features/programmable](/features/programmable),
  [/features/developer-portal](/features/developer-portal),
  [/features/mcp-servers](/features/mcp-servers),
  [/features/rate-limiting](/features/rate-limiting),
  [/features/authentication](/features/authentication),
  [/features/open-api](/features/open-api)

Ship API management your way — free to start, production-ready on day one, built
for teams that don't want to write XML.