Multiple Auth Methods
Support API keys, JWT, OAuth 2.0, and mTLS — all configured with simple policies, no custom code required.
Security
API Security
Protect your APIs from unauthorized access, abuse, and attacks with built-in authentication, authorization, and bot protection running at the edge.
Edge-Native Enforcement
Security policies run at the edge, blocking malicious requests before they reach your origin server.
Built-In WAF
Integrated Web Application Firewall (WAF) in partnership with Akamai protects against OWASP Top 10 threats.
Security
Authentication & Authorization
Configure API key authentication, JWT validation, OAuth 2.0, or OpenID Connect with a single policy. Combine multiple auth methods and implement RBAC with TypeScript for fine-grained access control.
Learn more in the docs
Security
Request Validation
Validate incoming requests against your OpenAPI schema automatically. Reject malformed requests, enforce required fields, and validate data types before they reach your backend.
Learn more in the docs
Security
Bot & Abuse Protection
Detect and block bot traffic, scrapers, and abusive clients using rate limiting, IP allowlists, and behavioral analysis — all configurable without writing code.
Learn more in the docs
Frequently
Asked
Questions
Common questions about API Security.
What authentication methods does Zuplo support?
Zuplo supports API key authentication, JWT validation (RS256, HS256), OAuth 2.0, OpenID Connect, mTLS, and basic auth. Multiple methods can be combined on the same gateway.
How does Zuplo handle JWT validation?
Zuplo validates JWTs at the edge using your JWKS endpoint or inline public key. Claims are extracted and made available to downstream policies for authorization decisions.
Can I implement custom authorization logic?
Yes. After authentication, you can write TypeScript policies to implement RBAC, ABAC, or any custom authorization logic. Access user claims, API key metadata, and request data to make authorization decisions.
Does Zuplo provide DDoS protection?
Yes. Zuplo runs on top of global edge networks including Cloudflare's, which provides DDoS protection. Combined with Zuplo's rate limiting, your APIs are protected from volumetric and application-layer attacks.
Ready to get started?
Join thousands of developers who trust Zuplo to secure, scale, and monetize their APIs.