---
title: "Programmable API Management"
description:
  "Developer portals, auth, rate limiting, and full programmability on one
  platform — the same gateway that governs your AI and MCP traffic. Configured
  out of the box, customizable in TypeScript, deployed globally via GitOps."
canonicalUrl: "https://zuplo.com/api-management"
sourceUrl: "https://zuplo.com/api-management"
pageType: "product"
generatedAt: "2026-09-04"
---

# Programmable API Management

> Stop stitching together a gateway, a portal, auth, and analytics. Everything
> it takes to run an API in production on one platform — programmable in
> TypeScript when the defaults don't fit, and now running your AI and MCP
> traffic too.

## Everything you need to manage APIs at scale

Authentication, rate limiting, developer portals, MCP servers, and full
programmability — in one platform.

- **Programmable** — Never limited by your gateway's config. Configure the
  standard policies without code. When defaults don't fit, TypeScript is the
  escape hatch — not the starting point. ([Learn more](/features/programmable))
- **Dev Portal** — Developer portals that don't suck. Customers subscribe,
  manage keys, and see usage — always in sync with your API.
  ([Learn more](/features/developer-portal))
- **MCP Server** — Turn your API into an MCP server. Your OpenAPI spec becomes
  MCP tools that agents can discover and call safely. Related:
  [AI Gateway](/ai-gateway), [MCP Gateway](/mcp-gateway).
  ([Learn more](/features/mcp-servers))
- **Rate Limit** — Rate limiting, your way. Throttle by endpoint, key, user, or
  any condition — simple limits now, programmable logic when you need it.
  ([Learn more](/features/rate-limiting))
- **Authentication** — Authentication, without the pain. Every auth method,
  production-grade out of the box — and secret scanning catches leaks before
  they ship. ([Learn more](/features/authentication))
- **Open API** — One standard through the lifecycle. Built on OpenAPI, shipped
  via git commit — governance that doesn't slow teams down.
  ([Learn more](/features/open-api))

## When presets aren't enough, drop into code

Every policy is just a TypeScript function — customize it, ship it via git.
Here's role-based access in practice.

```typescript
// custom-rbac-policy.ts
export default async function policy(
  request: ZuploRequest,
  context: ZuploContext,
  options: { role: string },
) {
  if (request.user.data.roles.includes(options.role)) {
    return request;
  }
  return new Response("User does not have the correct permissions", {
    status: 403,
  });
}
```

Need a hand writing your first policy? Spend 30 minutes with a Zuplo architect —
they'll map your APIs and sketch the policy you need, in TypeScript. (Meeting
request form: "Request a meeting".)

## Frequently Asked Questions

Learn about API management and how Zuplo helps your team build better APIs.

**What is API management and why does it matter?** API management is the
practice of designing, securing, deploying, and observing APIs at scale. It
covers authentication, rate limiting, developer portals, monetization,
analytics, and lifecycle governance. Zuplo handles all of this on a single
programmable platform — so your APIs ship faster and stay reliable as they grow.

**How is Zuplo different from legacy API management platforms?** Legacy
platforms like Apigee, Mulesoft, or Azure API Management rely on XML workflows,
GUI-driven configuration, or proprietary DSLs. Zuplo lets you write real
TypeScript for any policy or transformation, deploy via GitOps, and version
everything with git. You get unlimited extensibility without locking yourself
into a vendor's expression language.

**Can I use my existing OpenAPI specs?** Yes — OpenAPI is Zuplo's source of
truth. Drop in your spec and Zuplo generates routes, validates requests, drives
the developer portal, and powers your MCP server. Update the spec via a git
commit and Zuplo's deployment pipeline takes care of the rest.

**How does authentication work in Zuplo?** Zuplo ships first-class policies for
API keys, JWT, OAuth 2.0, Basic Auth, mTLS, and secure tunnels. API keys are
managed through a self-serve portal with built-in rotation, scoping, and GitHub
secret scanning that catches leaks before they reach production. You can also
write a custom auth policy in TypeScript for any non-standard scheme.

**Where does Zuplo run?** Zuplo deploys to 300+ edge locations globally. You can
also run Zuplo as Managed Dedicated on AWS, Azure, GCP, Akamai, or Equinix, or
self-host in your own Kubernetes cluster. The same TypeScript policies, OpenAPI
specs, and GitOps workflow apply across every deployment target.

**Can I monetize my APIs with Zuplo?** Yes. Zuplo includes built-in monetization
that lets you offer tiered pricing, usage-based billing, and self-serve
subscriptions directly from your developer portal — no separate billing system
to maintain. Combine it with custom quotas for fine-grained per-tier metering.

Want a demo of Zuplo? [Talk to an API expert](/schedule-call).

## Next steps

- Start for free: https://portal.zuplo.com/signup
- Talk to an API Expert:
  [/schedule-call](/schedule-call?utm_content=api-management)