---
title: "Platform Features"
description:
  "Every Zuplo platform feature in one index: authentication, rate limiting, caching, monetization, observability, governance, MCP servers, GitOps, and more."
canonicalUrl: "https://zuplo.com/features"
sourceUrl: "https://zuplo.com/features"
pageType: "other"
generatedAt: "2026-10-08"
---

# Everything You Need to Manage APIs

> Everything it takes to secure, scale, and govern an API — and the AI agents that call it — built into one platform, so your team ships product instead of assembling infrastructure.

## Platform features

- [API Caching](/features/caching) (Traffic Control) — Edge response caching, semantic cache for AI workloads, and CDN-aware Cache-Control headers — all configured per route, no Redis cluster to operate.
- [API Governance](/features/api-governance) (Governance) — Shared policies and Composite Inbound bundles applied to every route — auth, rate limits, schema validation, audit logging — enforced in CI before merge. SOC 2 Type II, immutable account audit logs, RBAC, fine-grained API key scopes.
- [API Key Management](/features/api-key-management) (Authentication) — Hashed-at-rest, edge-replicated API keys with self-serve issuance, rolling rotation, custom metadata, and GitHub leak detection — validated in single-digit milliseconds across 300+ data centers.
- [API Monetization](/features/api-monetization) (Monetization) — Subscriptions, plan-scoped API keys, real-time metering, soft and hard quotas, and a self-serve pricing page — everything you need to bill for an API, in one policy on every route.
- [API Observability](/features/api-observability) (Observability) — Real-time logs and analytics for every request through your gateway. Searchable, filterable, exportable — with consumer-level attribution and integrations into your existing stack.
- [API Security](/features/api-security) (Security) — Multi-method authentication, schema validation, rate limiting, bot protection, and workload identity federation to your backends — all enforced in one edge runtime, in 300+ data centers.
- [Authentication](/features/authentication) (Authentication) — API keys, JWT, OAuth 2.0, OpenID Connect, mutual TLS, and TypeScript-based custom auth — composable per route, edge-validated, no SDK to install.
- [Backends & Resilience](/features/backends) (Security) — Workload identity federation, Azure AD, mTLS, secure tunnels, retries, timeouts, and a circuit breaker — all running at the edge across 300+ data centers.
- [Developer Portal](/features/developer-portal) (Developer Experience) — Auto-generated docs from OpenAPI, interactive API explorer, self-serve API keys, custom React pages, and your custom domain — built into every Zuplo project, hosted for you.
- [GitOps](/features/gitops) (Developer Workflow) — Your gateway is files in your Git repo. Every push deploys atomically. Every PR gets a preview URL on the global edge. Every revert is a `git revert`.
- [Global High Performance](/features/global-high-performance) (Infrastructure) — Deploy to 300+ edge locations in under 20 seconds. Sub-50ms latency worldwide, a 99.999% uptime SLA, and zero infrastructure to manage.
- [GraphQL](/features/graphql) (Standards) — Put your GraphQL endpoint behind Zuplo — depth and complexity limits, introspection control, operation-aware analytics, a one-line GraphQL-to-MCP server, and a schema-aware playground. The same gateway as your REST APIs.
- [MCP Server](/features/mcp-servers) (AI & MCP) — Turn any OpenAPI spec into a remote MCP server in your gateway — tools, resources, and prompts derived from your existing routes. Streamable HTTP, edge-deployed, with the same OAuth, API keys, rate limits, and audit logging as your APIs.
- [Multi-Cloud Gateway](/features/multi-cloud) (Infrastructure) — Run Zuplo on managed edge, single-tenant dedicated (Akamai, AWS, Azure, GCP, Equinix), or self-hosted Helm on any Kubernetes — all behind one control plane. Reach private backends with WireGuard tunnels, PrivateLink, mTLS, AWS IAM, Azure AD, and GCP IAM.
- [OpenAPI Support](/features/open-api) (Standards) — Zuplo's gateway config IS an OpenAPI document. Routes, policies, request validation, the developer portal, and exported client SDKs all derive from one spec. OpenAPI 3.0/3.1, YAML or JSON, with overlays for environment-specific config and edge-enforced validation.
- [Programmable Gateway](/features/programmable) (Customization) — Custom inbound policies, outbound policies, and request handlers in typed TypeScript. Web-standard APIs (Fetch, Crypto, Streams), V8 isolates across 300+ POPs. Compose other routes with context.invokeRoute, share state via context.custom — no proprietary DSL, no separate Lambdas.
- [Rate Limiting](/features/rate-limiting) (Traffic Control) — Per-IP, per-API-key, per-tenant, and per-token rate limits at the edge — plus monthly quotas. Programmable in TypeScript, configurable in JSON, enforced before traffic touches your origin.
- [Testing](/features/testing) (Developer Workflow) — The same test suite runs against local dev, a real per-branch preview deployment, and production — one command, one `--endpoint` flag. `zuplo test` ships with the CLI on every plan; tests are plain TypeScript in your repo, next to the config they test.
- [Unlimited Environments](/features/unlimited-environments) (Developer Workflow) — Every Git branch is a real environment on the global edge — production, staging, feature previews, per-developer working copies. Three stages, three env-var scopes, no per-environment licensing, on every plan.

## Next steps

Join thousands of developers who trust Zuplo to secure, scale, and govern their APIs — for users and AI agents alike.

- [Start for Free](https://portal.zuplo.com/signup)
- [Book a Demo](/schedule-call)