# Zuplo Blog

> Engineering articles, tutorials, and analysis about APIs, AI gateways, MCP, security, and developer platforms.

Each link is a direct Markdown representation. The root site index is available at [zuplo.com/llms.txt](https://zuplo.com/llms.txt).

## Articles

- [4 MCP Monetization Models for Agentic Commerce](https://zuplo.com/blog/mcp-monetization-models.md): There are a number of emerging ways to monetize MCP: charge for the API underneath, gate access as a plan feature, meter tool calls, or bill by the outcome.
- [Why Agentic Tool Calls Need Least Privilege](https://zuplo.com/blog/agentic-tool-calls-least-privilege.md): Consider what agents actually need to access to do their job, and nothing more. How least privilege and curated MCP tool catalogs limit what agents can touch.
- [10 MCP Server Generators Compared](https://zuplo.com/blog/mcp-server-generators-compared.md): We compare 10 tools that turn an OpenAPI spec into an MCP server — gateway platforms, SDK tools, and open-source generators — and when to reach for each one.
- [Run a Load Test Like a Production Launch](https://zuplo.com/blog/api-load-testing-playbook.md): A large API load test is an operational event. Use this playbook to coordinate providers, define success and abort criteria, budget the run, validate business systems, and turn results into a capacity plan.
- [Why 'Bring Your Own Agent' Is Key to MCP Infrastructure](https://zuplo.com/blog/bring-your-own-agent-mcp-infrastructure.md): Platforms and models change fast. Here's why MCP infrastructure should work with any agent or model you're using, not just the one that's popular today.
- [An MCP Server Registry Built Into Your Gateway](https://zuplo.com/blog/mcp-server-registry-gateway.md): Zuplo gateways can expose their MCP routes through the standard MCP Server Registry API. The read-only catalog is generated from live route config, so there is no second datastore to maintain.
- [Why MCP Gateways Should Use Existing Authentication Services](https://zuplo.com/blog/mcp-gateways-existing-auth-services.md): An MCP gateway shouldn't replace the IdP you already run. Here's why identity servers and MCP gateways work best as separate, complementary concerns — and what 'bring your own IdP' should mean in practice.
- [How to Manage Authentication and Authorization for MCP in Multi-Agent Systems](https://zuplo.com/blog/mcp-auth-multi-agent-systems.md): Multi-agent systems each need uniquely scoped MCP access. Here's how privilege drift, inconsistent server auth, and ungoverned usage creep in — and why a gateway is the place to govern agent-to-tool access.
- [Attribute AI Spend to Teams and Apps](https://zuplo.com/blog/attribute-ai-spend-teams-apps.md): Zuplo AI Gateway now attributes usage to apps and teams, enforces spend limits at every level, and adds new controls for routing and sensitive data.
- [Reading Load Test Results with Distributed Tracing](https://zuplo.com/blog/load-testing-with-tracing.md): A load test shows that latency increased or requests failed. Distributed tracing shows where. Learn how to attribute errors, measure hops with one clock, propagate trace context, and account for tracing overhead.
- [Load Testing Through Proxies, Gateways, and CDNs](https://zuplo.com/blog/load-testing-gateways-and-cdns.md): A full-path load test measures every proxy, gateway, CDN, and load balancer in front of your API. Learn how to budget latency, warm the path, validate rate limits, control caching, and identify the failing layer.
- [Load Testing Your API from Multiple Regions](https://zuplo.com/blog/load-test-from-multiple-regions.md): Generator placement changes the network path, regional routing, and source IPs in an API load test. Learn how to build a multi-region test that measures the system you intended to test.
- [How Not to Load Test an API](https://zuplo.com/blog/how-not-to-load-test-an-api.md): A load test can make a failing API look fast and a healthy API look slow. Learn how to segment results, choose the right workload model, and report percentiles without distorting them.
- [Give Claude Tag One API Key, Not Ten](https://zuplo.com/blog/claude-tag-single-api-proxy.md): Claude Tag wants a service account and a credential for every API you connect. Route it through one Zuplo proxy instead: one API key, path-based routing to every service, and an audit log of every API call the agent makes.
- [Per-Role Tool Catalogs for Your MCP Server](https://zuplo.com/blog/per-role-mcp-tool-catalogs.md): Least privilege for agents is usually all-or-nothing. Front one upstream MCP server with two gateway routes, give each its own tool catalog, and gate them by the IdP group your team already belongs to.
- [Give Teams Scoped AI Access Without Separate Infrastructure](https://zuplo.com/blog/give-teams-scoped-ai-access-without-separate-infrastructure.md): Most teams choose between one shared provider key everyone can drain or a separate gateway per team to babysit. The Zuplo AI Gateway scopes each team to the providers, models, and budget you assign, from one place.
- [Decouple Agent Auth From Your MCP Server](https://zuplo.com/blog/decouple-agent-auth-mcp-server.md): Your agent's cloud identity shouldn't be wired straight into your MCP server. Put a gateway in the middle to translate auth, hand the upstream a scoped token, and enforce role-based access on every tool.
- [Charge Agents for MCP Tool Calls](https://zuplo.com/blog/charge-agents-for-mcp-tool-calls.md): Your MCP server is live and agents call it for free. Authenticate each agent with an API key, then meter only the tool calls so protocol chatter stays free. Enforce each plan's quota and let Stripe bill the rest.
- [How to Avoid Shadow MCP Servers in the Enterprise](https://zuplo.com/blog/how-to-avoid-shadow-mcp-servers.md): Shadow MCP servers are the new shadow IT. Here's how to bring them under enterprise governance with inventory, monitoring, least privilege, and a gateway.
- [What Developers Want from an AI Gateway](https://zuplo.com/blog/what-developers-want-from-an-ai-gateway.md): We read the AI dev corners of Reddit and ranked the 14 things people actually want from an AI gateway, with where the Zuplo AI Gateway delivers (and where it doesn't).
- [MCP Registry vs. MCP Gateway: What's the Difference?](https://zuplo.com/blog/mcp-registry-vs-mcp-gateway.md): A registry is a static catalog for discovery, whereas a gateway is the control plane to manage, curate, and secure MCP tool access.
- [MCP, A2A, and Where ACP Went](https://zuplo.com/blog/agent-protocol-stack-mcp-a2a-acp-2026.md): MCP connects an agent to tools, A2A connects agents to each other, and ACP folded into A2A in 2025. Here is the agent protocol stack in 2026, spec-level, and how a gateway governs both.
- [AI Firewalls Are a Layer Not a Wall](https://zuplo.com/blog/ai-firewalls-layer-not-wall.md): AI firewalls and guardrails are a real defense-in-depth layer, and Anthropic builds them too. But probabilistic detection cannot be the primary control for an autonomous agent. The wall has to be deterministic.
- [Audit Every Tool Call Your Agents Make to MCP Servers](https://zuplo.com/blog/audit-agent-mcp-tool-calls.md): A direct connection to a third-party MCP server leaves no record of what your agents called. Route it through a gateway and every tool call is logged, attributed to an identity, and ready to ship to your SIEM.
- [Publish an Agentic Resource Discovery Manifest with Zuplo](https://zuplo.com/blog/agentic-resource-discovery.md): Agentic Resource Discovery gives AI agents a standard way to find your MCP servers and APIs. Here's what the discovery manifest holds and how to serve it from your Zuplo gateway.
- [7 Common MCP Security Flaws and Vulnerabilities](https://zuplo.com/blog/7-common-mcp-security-flaws.md): If you're using MCP in your workflows or building MCP servers, be sure to avoid these common MCP security anti-patterns.
- [Expose Only the MCP Tools You Choose](https://zuplo.com/blog/expose-only-mcp-tools-you-choose.md): Point an agent at an MCP server and its destructive tools sit one bad inference away from a read task. Front the server with a gateway, allowlist the tools you trust, and everything else stops existing on that route.
- [Zuplo Joins Okta's Cross App Access (XAA) Ecosystem](https://zuplo.com/blog/zuplo-okta-cross-app-access-launch-partner.md): Zuplo is a launch partner in Okta's Cross App Access ecosystem. Here's what XAA is, why it matters for AI agents, and how agent traffic now flows through Okta's identity engine at the gateway.
- [MCP Gateways: Buy or Build Your Own?](https://zuplo.com/blog/mcp-gateway-buy-or-build.md): Weigh the benefits and drawbacks of building your own MCP gateway versus using a managed one.
- [Use an MCP Gateway With Vercel Eve Agents](https://zuplo.com/blog/use-an-mcp-gateway-with-vercel-eve-agents.md): Most MCP gateways are built for a human to sign in, but a scheduled agent has no one at the keyboard. Here's how to run a Vercel Eve agent against Zuplo's MCP Gateway unattended, no static key required.
- [Expose Internal APIs as Governed MCP Tools](https://zuplo.com/blog/expose-internal-apis-as-mcp-tools.md): Give AI agents your internal API as MCP tools without pasting credentials into editors. Expose chosen operations as an MCP server in Zuplo, then front it with the MCP Gateway for SSO, tool curation, and a per-call audit trail.
- [A Remote MCP Server Can Rug Pull You](https://zuplo.com/blog/remote-mcp-server-rug-pull.md): You vet a remote MCP server's tools once, but the operator can rewrite those descriptions any time, and the new version lands in your agent's context with no re-prompt. Here is what holds at the boundary.
- [What Regulators Now Expect From AI Agents](https://zuplo.com/blog/what-regulators-expect-ai-agents.md): In early 2026 NIST, six national cyber agencies, and an ISO management standard converged on the same demands for AI agents: least privilege, a verified per-agent identity, a kill switch, and an audit trail. All four live at the gateway.
- [Bind Every MCP Token to One Server](https://zuplo.com/blog/bind-mcp-tokens-to-one-server.md): Two MCP servers behind one identity provider, an issuer-only check, and a token minted for one walks into the other. Audience binding pins each token to a single server.
- [Your Team Already Installed Shadow MCP](https://zuplo.com/blog/shadow-mcp-governance.md): Developers paste GitHub, Slack, and Stripe keys into editor configs to wire up MCP servers nobody approved. Govern this shadow MCP with an MCP gateway, don't ban it.
- [Wrap a Token-Only MCP Server in OAuth](https://zuplo.com/blog/wrap-token-only-mcp-server-in-oauth.md): Plenty of MCP servers ship one auth option: a static token you paste into every client. Front it with the Zuplo MCP Gateway and clients get a real OAuth flow while the token stays sealed in the gateway.
- [Why Enterprises Need an MCP Gateway](https://zuplo.com/blog/why-enterprises-need-an-mcp-gateway.md): If you plan to connect AI agents with MCP servers at scale, you'll need a central layer to govern MCP tool use and retain proper tool access control.
- [RBAC Isn't Enough for AI Agents](https://zuplo.com/blog/fine-grained-authz-ai-agents.md): One agent acts for hundreds of users across thousands of resources. A role or a coarse allowlist can't express 'this agent, for Alice, may read document 42.' Authorization for agents has to be per-resource and relationship-aware.
- [What the Best MCP Gateways Do in 2026](https://zuplo.com/blog/what-the-best-mcp-gateways-do-in-2026.md): MCP gateways are a year old as a category. The shape of the right answer is starting to settle. Ten things every MCP gateway should do, plus three traps to avoid.
- [Re-Evaluating Your MCP Gateway After the Portkey Acquisition](https://zuplo.com/blog/mcp-gateway-after-the-portkey-acquisition.md): When PANW acquired Portkey, every MCP gateway contract became worth a second look. Five questions on audit trails, compliance retention, governance, and roadmap ownership to ask before your next renewal.
- [Anthropic Just Made the Case for MCP Gateways](https://zuplo.com/blog/anthropic-made-the-case-for-mcp-gateways.md): Anthropic's containment post never names a gateway. But its core lesson, contain agents at a deterministic boundary and treat every allowlist as a capability grant, is exactly what an MCP gateway gives you off the shelf.
- [Front a Third-Party Server with the Zuplo MCP Gateway](https://zuplo.com/blog/set-up-virtual-mcp-server-portal.md): Put a third-party MCP server behind real auth and tool curation without writing a line of config. We front Linear with the Zuplo MCP Gateway, strip its destructive tools, and connect it to Claude, all in the portal.
- [MCP Gateway Comparison: 10 Tools for AI Agent Access](https://zuplo.com/blog/mcp-gateway-comparison.md): We compare 10 MCP gateways for governing AI agent access — security, observability, deployment model, and standout features side by side.
- [Introducing the Zuplo MCP Gateway](https://zuplo.com/blog/introducing-zuplo-mcp-gateway.md): AI agents have unprecedented access to your critical systems. Do you know what they're doing? The generally available MCP Gateway lets you monitor, control, and customize how agents reach your APIs through MCP.
- [How auth.md Standardises Agent Signup](https://zuplo.com/blog/auth-md-agent-signup.md): auth.md is a new open protocol that gives agents a standard way to register with an API on a user's behalf, no human filling out a signup form. Here's how it works and why it matters.
- [Arazzo Goes Cross-Protocol](https://zuplo.com/blog/arazzo-goes-cross-protocol.md): Version 1.1 ships AsyncAPI as a first-class source description, workflow-to-workflow chaining, and a Selector Object for pulling values out of responses. What started as an OpenAPI sidekick has graduated into a cross-protocol workflow spec.
- [Meet the Zuplo MCP Server](https://zuplo.com/blog/introducing-the-zuplo-mcp-server.md): The Zuplo MCP server exposes the full Developer API as tools so Claude Code, Cursor, or any MCP client can manage deployments, keys, and domains.
- [Introducing Agents Analytics](https://zuplo.com/blog/introducing-agents-analytics.md): Zuplo Analytics now classifies AI agent traffic. See ChatGPT, Claude, Cursor and more as first-class consumers of your API.
- [Never Ship an MCP Server Without a Rate Limit](https://zuplo.com/blog/never-ship-mcp-server-without-rate-limit.md): GitHub's MCP server inherits the 5,000/hour REST API limit, and that's the only thing standing between an agent and a suspended account. Most public MCP servers either have no limit, the wrong limit, or one so tight it breaks their own protocol. Put a real rate limit on every MCP route you publish.
- [Rate Limiting and API Monetization Through the Developer Portal](https://zuplo.com/blog/rate-limit-and-monetize-with-dev-portal.md): A developer portal is where API rate limits and pricing plans stop being internal config and become something paying customers can see, pick, and use without filing a support ticket.
- [Fire Email Alerts From a Zuplo Policy](https://zuplo.com/blog/sending-email-from-a-zuplo-policy.md): Send a usage warning email straight from your gateway policy. No queue, no worker, no extra service. Just a fetch call to Resend at the threshold the gateway is already watching.
- [Why Rate Limiting by IP Breaks Your API](https://zuplo.com/blog/dont-rate-limit-by-ip.md): Carrier-grade NAT, cloud egress reuse, and shared proxies put unrelated callers behind one IP address, so an IP-based rate limit punishes the wrong people. Rate-limit by API key or JWT subject with Zuplo's rate-limit-inbound policy instead.
- [Rate Limit LLM APIs by Tokens Not Requests](https://zuplo.com/blog/rate-limit-llm-apis-by-tokens-not-requests.md): Requests-per-minute is the wrong meter for LLM endpoints. One call can be 50 tokens or 50,000. Rate limit on input and output tokens with Zuplo's complex-rate-limit-inbound policy and the real counts from each upstream response.
- [Canvas LMS Breach Forces Mass API Key Rotation](https://zuplo.com/blog/instructure-canvas-breach-api-key-rotation-lessons.md): Instructure's Canvas LMS breach forced emergency API key rotation across thousands of schools. Here's the operational playbook every API provider needs.
- [Provision API Keys at First Login](https://zuplo.com/blog/provision-api-keys-at-first-login.md): Most auth providers expose a hook into the signup flow. Use it to create a Zuplo API key consumer the moment a user lands on your developer portal.
- [API Key Week Wrap Up](https://zuplo.com/blog/api-key-week-wrap-up.md): We spent the week on API keys. Best practices, a self-serve settings page, dual-auth on a single route, and provisioning a key the moment a user signs in. The whole week in one place.
- [Using JWT and API Key Auth on the Same Route](https://zuplo.com/blog/using-jwt-and-api-key-auth-on-the-same-route.md): Different consumers want different credentials on the same route. Validate JWT or API key on a single endpoint and hand downstream code one identity shape regardless of which arrived.
- [How to Build a Production-Ready Flask REST API in 2026](https://zuplo.com/blog/flask-api-tutorial.md): Build a production-ready Flask REST API with rate limiting, API key authentication, and an auto-generated developer portal. A step-by-step Python tutorial with deployment.
- [Add Self-Serve API Keys to Your Own App](https://zuplo.com/blog/add-self-serve-api-keys-to-your-own-app.md): Hand-rolling API key management means hashing, rotation, leak detection, and a key store you can trust. The Zuplo API gives you all of it from any stack, in five HTTP calls.
- [The Missing Manual for API Keys](https://zuplo.com/blog/introducing-apikeys-guide.md): Best practices, patterns, and hard-won lessons for designing API key authentication. Free, open source, and built for both developers and the AI agents writing their integration code.
- [API Key Best Practices for 2026: 9 Rules Top APIs Follow](https://zuplo.com/blog/api-key-best-practices.md): How Stripe, Anthropic & Supabase design API keys — 9 best practices for building a key system that scales (prefixes, hashing, rotation, scoping).
- [How to Rate Limit an API](https://zuplo.com/blog/how-to-rate-limit-an-api.md): Rate limits stop one customer breaking your API for everyone else. This walkthrough takes you from an OpenAPI spec to a working rate limit on a Zuplo gateway, all from the portal.
- [Monetize an n8n AI Workflow with Zuplo](https://zuplo.com/blog/monetize-an-n8n-ai-workflow-with-zuplo.md): You've built a workflow with n8n and now you want to charge for it. Here's how to turn it into a billable API with keys, tiered rate limits, and Stripe-backed metering, without writing a billing pipeline from scratch.
- [Akamai's 2026 API Security Survey Shows an 87% Incident Rate](https://zuplo.com/blog/akamai-2026-api-security-survey-takeaways.md): Akamai's fourth-annual API Security Impact Survey: 87% of organizations hit by an API incident at $700K average cost. Five takeaways and what to do next.
- [Enable Stripe Tax for Your Monetized API](https://zuplo.com/blog/stripe-tax-for-your-monetized-api.md): Cross-border VAT and sales tax ship audits, not features. Stripe Tax inside Zuplo's billing profile gives you the right rates by customer location and invoice tax lines from one config change, not a separate engine.
- [Gate API Capabilities by Subscription Plan](https://zuplo.com/blog/capability-gating-static-features.md): Not every plan difference is a usage limit. Sometimes a feature is included on paid plans and not on Free, full stop. Static features in Zuplo plans handle capability gating directly, without writing custom auth checks or stuffing flags into consumer metadata.
- [How to Rate Limit AI Agents Beyond Request Counts](https://zuplo.com/blog/rate-limit-ai-agents-beyond-request-counts.md): A chatbot and a runaway automation loop both send ten requests a minute. One pays you, the other drains your compute. Fixed-window limiters can't tell them apart. Here's how to layer limits so AI agent traffic behaves.
- [Hard Limits, Soft Limits, and Progressive Friction for Monetized APIs](https://zuplo.com/blog/progressive-friction-for-monetized-apis.md): Surprise 429s break customer apps. Invisible usage climbs break customer budgets. Progressive friction is the third pattern most API teams land on, and it handles both by adding visibility: warn early, slow at the edge, stop only at runaway.
- [OpenAI Codex Ships 90+ Plugins with MCP Servers Inside](https://zuplo.com/blog/openai-codex-mcp-plugins-api-teams.md): OpenAI shipped 90+ new Codex plugins that bundle MCP servers alongside skills and integrations. Here's what this means for API teams preparing for agent-generated traffic.
- [Why Production AI Agent Endpoints Need an API Gateway](https://zuplo.com/blog/flowise-rce-ai-agent-endpoints-need-api-gateway.md): Flowise's CVSS 10.0 RCE vulnerability exposed 12,000+ AI agent builders. Productionised AI endpoints need gateway-level authentication, rate limiting, and access control.
- [Managing API Keys for AI Agents: Rotation, Scanning & Scale](https://zuplo.com/blog/managing-api-keys-for-ai-agents.md): How to manage API keys when AI agents are the consumer — edge validation, scannable key prefixes, fast rotation, and per-agent traceability with Zuplo.
- [How to Write Your First Custom API Gateway Policy in TypeScript](https://zuplo.com/blog/write-your-first-custom-api-gateway-policy-in-typescript.md): Custom gateway logic usually means Lua, VTL, or C# smuggled inside XML. Zuplo lets you write it as a TypeScript function using standard Request and Response objects. Here's how to build your first inbound and outbound policy.
- [Custom Enterprise API Pricing with Private Plans](https://zuplo.com/blog/custom-enterprise-api-pricing-without-cpq.md): Every enterprise deal that needs custom pricing is a hole in your self-serve funnel. Zuplo's private plans close it without a quoting system (CPQ), a coupon hack, or a separate invoicing pipeline.
- [Meter Only Successful API Responses, Not Errors](https://zuplo.com/blog/stop-paying-for-500s.md): Your gateway is counting every 500, timeout, and retry against your customers' quotas. Here's how Zuplo does it with a single line of config, and why most gateways make you write custom policy code to get the same behaviour.
- [6 Stats That Should Change How You Think About API Security](https://zuplo.com/blog/q1-2026-api-agent-security-scorecard.md): Q1 2026 produced record-breaking API attack data and a new class of AI agent threats. Here are the six stats every API team needs to see.
- [Build a NestJS API with OpenAPI and Zuplo](https://zuplo.com/blog/nestjs-api-tutorial.md): Build a REST API with NestJS and TypeScript, generate OpenAPI docs with @nestjs/swagger, and put it behind a Zuplo gateway with rate limiting, API key auth, and a developer portal.
- [Azure APIM's New Limits Make the Case for Zuplo](https://zuplo.com/blog/azure-api-management-new-service-limits-migration-guide.md): Azure APIM is rolling out new resource limits across all tiers starting March 2026. Here's what changed, who's affected, and why Zuplo is the smarter alternative.
- [Stanford Found 1,748 API Keys on the Open Web — Here's How to Stop Being One of Them](https://zuplo.com/blog/stanford-keys-on-doormats-api-key-security-lessons.md): A Stanford study scanned 10 million websites and found 1,748 live API credentials exposed in JavaScript bundles. Here's what went wrong and how to fix it.
- [Apigee Needed a Simplification Tool. Zuplo Did Not.](https://zuplo.com/blog/google-open-sources-apigee-feature-templater.md): Google's new Apigee Feature Templater admits Apigee is too complex for non-experts. Zuplo's TypeScript-first API gateway was designed to be simple from the start.
- [OpenAPI Arazzo & Overlay: Workflows and Spec Management](https://zuplo.com/blog/openapi-arazzo-overlay-specifications-guide.md): Learn how the OpenAPI Overlay and Arazzo specifications enable repeatable API description management and workflow orchestration for gateway teams and AI agents.
- [AI Is Eating SaaS: Your Data Is the Product Now](https://zuplo.com/blog/ai-is-eating-saas.md): The SaaS UI is becoming irrelevant. As AI agents replace human workflows, companies are realizing their real asset is data — and they need to make it programmable, secure, and monetizable.
- [Building a Monetized API, Part 4: Polishing the Developer Portal](https://zuplo.com/blog/building-a-monetized-api-part-4.md): Connect your Zuplo project to GitHub, use Claude Code to generate documentation from your OpenAPI spec, apply a custom theme, and ship a production-ready developer portal.
- [Building a Monetized API, Part 3: How to Monetize an MCP Server](https://zuplo.com/blog/monetize-an-mcp-server.md): Monetize an MCP server on Zuplo by gating access to paid plans. Block free users with a 403, let Starter and Pro subscribers connect using their existing API key.
- [How to Make AI Coding Agents Understand Your API Gateway](https://zuplo.com/blog/ai-coding-agents-understand-api-gateway.md): AI coding agents generate outdated Zuplo config from stale training data. Fix it with version-matched docs, agent skills, and an MCP server.
- [Building a Monetized API, Part 2: Adding Monetization](https://zuplo.com/blog/building-a-monetized-api-part-2.md): Add usage-based billing, metered plans, and Stripe checkout to your API gateway. Set up meters, create free and paid plans with overage pricing, and enable self-serve subscriptions in the developer portal.
- [10 API Monetization Anti-Patterns: What Not To Do](https://zuplo.com/blog/api-monetization-anti-patterns.md): There's a lot you can do wrong when charging for API access. Here are a few lessons learned and advice to optimize your API monetization journey.
- [Building a Monetized API, Part 1: Setting Up the Gateway](https://zuplo.com/blog/building-a-monetized-api-part-1.md): Before you can charge for your API, you need the gateway set up right. Set up origin auth, consumer isolation, and rate limiting as the foundation for adding monetization.
- [Monetize Your API with Zuplo](https://zuplo.com/blog/monetize-your-api-in-10-mins.md): API Monetization is now self-serve in Zuplo. Set up plans, metering, Stripe checkout, and a developer portal for your API in under 10 minutes.
- [Shadow APIs Outnumber Known APIs 10-to-1 in Financial Services](https://zuplo.com/blog/shadow-apis-fintech-api-gateway-governance.md): Shadow APIs outnumber known APIs 10-to-1 in fintech. Learn why API gateway governance is critical and how to secure your financial API integrations.
- [Gartner: 75% of API Gateways Will Integrate MCP by 2026](https://zuplo.com/blog/gartner-75-percent-api-gateways-mcp.md): Gartner projects 75% of API gateway vendors will integrate MCP features by 2026. Here's why this validates the convergence of API gateways and AI agent infrastructure — and what real MCP readiness requires.
- [87% of Organizations Were Hit by API Attacks in 2025 — Akamai SOTI Report](https://zuplo.com/blog/apis-number-one-attack-surface-2026-akamai-soti-report.md): Akamai's 2026 SOTI report reveals 87% of organizations suffered API security incidents. Learn the top vulnerabilities and how to defend your APIs at the edge.
- [Why MCP Is The Doorway To API-Based Business](https://zuplo.com/blog/why-mcp-is-the-doorway-to-api-based-business.md): When we talk about MCP, we're really talking about APIs — and the vast economy behind monetized API products.
- [How Stripe MPP Lets AI Agents Pay for Your API](https://zuplo.com/blog/stripe-mpp-for-agentic-payments.md): MPP is a new open standard from Stripe and Tempo that lets agents pay for API access in a single HTTP request. Here's how it works, how it compares to x402, and what it means for developers building APIs for agents.
- [Build and Secure an Express.js REST API with Zuplo](https://zuplo.com/blog/expressjs-api-tutorial.md): Build a REST API with Express.js, generate an OpenAPI spec, and put it behind a production-grade gateway with rate limiting, API key auth, and a developer portal, no middleware required.
- [APIs Are Now the #1 Exploited Attack Surface](https://zuplo.com/blog/wallarm-2026-api-threatstats-api-security.md): Wallarm's 2026 API ThreatStats Report reveals APIs account for 43% of CISA's exploited vulnerabilities. Here's what the data means and how to protect your APIs.
- [Apigee Edge Is Reaching End of Life — Here's a Better Path Forward](https://zuplo.com/blog/apigee-edge-end-of-life-migrate-to-zuplo.md): Apigee Edge is reaching end of life, and migrating to Apigee X isn't your only option. Learn why teams are choosing Zuplo as a modern, developer-first alternative.
- [5 API Monetization Success Stories](https://zuplo.com/blog/5-api-monetization-success-stories.md): Explore five API monetization success stories from Plaid, AssemblyAI, OpenAI, Algolia, and SendGrid to see how usage-based pricing drives revenue at scale.
- [How to implement a circuit breaker at the API gateway](https://zuplo.com/blog/how-to-implement-circuit-breaker-at-the-api-gateway.md): When a backend fails, retry storms can make recovery even harder. Learn how to implement the circuit breaker pattern as custom TypeScript policies in Zuplo to automatically stop traffic to failing services, with per-route thresholds and RFC 7807 error responses.
- [WebMCP: How Websites Will Expose Tools to AI Agents](https://zuplo.com/blog/what-is-webmcp.md): WebMCP is a proposed W3C standard that lets websites declare their capabilities as structured tools that AI agents can call directly in the browser.

## More

- [Complete articles feed](https://zuplo.com/blog/rss.xml): RSS 2.0 feed for all entries; 184 older entries are omitted from this concise index.