---
title: "Platform Features"
description:
  "Every Zuplo platform feature in one index: authentication, rate limiting,
  caching, monetization, observability, governance, MCP servers, GitOps, and
  more."
canonicalUrl: "https://zuplo.com/features"
sourceUrl: "https://zuplo.com/features"
pageType: "product"
generatedAt: "2026-09-05"
---

# Everything You Need to Manage APIs

> Everything it takes to secure, scale, and govern an API — and the AI agents
> that call it — built into one platform, so your team ships product instead of
> assembling infrastructure.

## Features

- **[API Caching](/features/caching)** — Traffic Control. Edge response caching,
  semantic cache for AI workloads, and CDN-aware Cache-Control headers — all
  configured per route, no Redis cluster to operate.
- **[API Governance](/features/api-governance)** — Governance. Shared policies
  and Composite Inbound bundles applied to every route — auth, rate limits,
  schema validation, audit logging — enforced in CI before merge. SOC 2 Type II,
  immutable account audit logs, RBAC, fine-grained API key scopes.
- **[API Key Management](/features/api-key-management)** — Authentication.
  Hashed-at-rest, edge-replicated API keys with self-serve issuance, rolling
  rotation, custom metadata, and GitHub leak detection — validated in
  single-digit milliseconds across 300+ data centers.
- **[API Monetization](/features/api-monetization)** — Monetization.
  Subscriptions, plan-scoped API keys, real-time metering, soft and hard quotas,
  and a self-serve pricing page — everything you need to bill for an API, in one
  policy on every route.
- **[API Observability](/features/api-observability)** — Observability.
  Real-time logs and analytics for every request through your gateway.
  Searchable, filterable, exportable — with consumer-level attribution and
  integrations into your existing stack.
- **[API Security](/features/api-security)** — Security. Multi-method
  authentication, schema validation, rate limiting, bot protection, and workload
  identity federation to your backends — all enforced in one edge runtime, in
  300+ data centers.
- **[Authentication](/features/authentication)** — Authentication. API keys,
  JWT, OAuth 2.0, OpenID Connect, mutual TLS, and TypeScript-based custom auth —
  composable per route, edge-validated, no SDK to install.
- **[Backends & Resilience](/features/backends)** — Security. Workload identity
  federation, Azure AD, mTLS, secure tunnels, retries, timeouts, and a circuit
  breaker — all running at the edge across 300+ data centers.
- **[Developer Portal](/features/developer-portal)** — Developer Experience.
  Auto-generated docs from OpenAPI, interactive API explorer, self-serve API
  keys, custom React pages, and your custom domain — built into every Zuplo
  project, hosted for you.
- **[GitOps](/features/gitops)** — Developer Workflow. Your gateway is files in
  your Git repo. Every push deploys atomically. Every PR gets a preview URL on
  the global edge. Every revert is a `git revert`.
- **[Global High Performance](/features/global-high-performance)** —
  Infrastructure. Deploy to 300+ edge locations in under 20 seconds. Sub-50ms
  latency worldwide, a 99.999% uptime SLA, and zero infrastructure to manage.
- **[GraphQL](/features/graphql)** — Standards. Put your GraphQL endpoint behind
  Zuplo — depth and complexity limits, introspection control, operation-aware
  analytics, a one-line GraphQL-to-MCP server, and a schema-aware playground.
  The same gateway as your REST APIs.
- **[MCP Server](/features/mcp-servers)** — AI & MCP. Turn any OpenAPI spec into
  a remote MCP server in your gateway — tools, resources, and prompts derived
  from your existing routes. Streamable HTTP, edge-deployed, with the same
  OAuth, API keys, rate limits, and audit logging as your APIs.
- **[Multi-Cloud Gateway](/features/multi-cloud)** — Infrastructure. Run Zuplo
  on managed edge, single-tenant dedicated (Akamai, AWS, Azure, GCP, Equinix),
  or self-hosted Helm on any Kubernetes — all behind one control plane. Reach
  private backends with WireGuard tunnels, PrivateLink, mTLS, AWS IAM, Azure AD,
  and GCP IAM.
- **[OpenAPI Support](/features/open-api)** — Standards. Zuplo's gateway config
  IS an OpenAPI document. Routes, policies, request validation, the developer
  portal, and exported client SDKs all derive from one spec. OpenAPI 3.0/3.1,
  YAML or JSON, with overlays for environment-specific config and edge-enforced
  validation.
- **[Programmable Gateway](/features/programmable)** — Customization. Custom
  inbound policies, outbound policies, and request handlers in typed TypeScript.
  Web-standard APIs (Fetch, Crypto, Streams), V8 isolates across 300+ POPs.
  Compose other routes with `context.invokeRoute`, share state via
  `context.custom` — no proprietary DSL, no separate Lambdas.
- **[Rate Limiting](/features/rate-limiting)** — Traffic Control. Per-IP,
  per-API-key, per-tenant, and per-token rate limits at the edge — plus monthly
  quotas. Programmable in TypeScript, configurable in JSON, enforced before
  traffic touches your origin.
- **[Testing](/features/testing)** — Developer Workflow. The same test suite
  runs against local dev, a real per-branch preview deployment, and production —
  one command, one `--endpoint` flag. `zuplo test` ships with the CLI on every
  plan; tests are plain TypeScript in your repo, next to the config they test.
- **[Unlimited Environments](/features/unlimited-environments)** — Developer
  Workflow. Every Git branch is a real environment on the global edge —
  production, staging, feature previews, per-developer working copies. Three
  stages, three env-var scopes, no per-environment licensing, on every plan.

## Next steps

- Start for Free — https://portal.zuplo.com/signup
- Book a Demo — [/schedule-call](/schedule-call)