API Key Authentication

Secure Your Lapis API with API Keys

The Zuplo API Gateway protects your backend API from unauthorized access, abuse, and overload. Add API key authentication to your Lapis API in minutes.

Secure Access

Authenticate every request before it reaches your backend.

Control Costs

Set rate limits and quotas to prevent runaway usage.

Ensure Reliability

Shield your backend from overload with traffic management.

How it works

The Zuplo API Gateway sits between your clients and your Lapis backend, providing a secure layer of protection and control.

Client

Zuplo API Gateway

Customer VPC

Backend

Step-by-step tutorial

It takes only a few minutes to put Zuplo in front of your Lapis backend, adding API key authentication, and configuring your origin to trust requests from Zuplo using JWT verification.

Create a Route in Zuplo

First, create a new route in your Zuplo project that will proxy requests to your Lapis backend. This route will be the entry point for your API consumers.

Learn how to create routes

📄 OpenAPI native. Import your existing OpenAPI spec to instantly create routes and power your API documentation .

Add API Key Authentication Policy

Add the API Key Authentication policy to your route. This policy validates incoming API keys and ensures only authorized consumers can access your API.

Adding API Key Authentication policy in Zuplo

API Key Authentication docs

🔐 Leaked key? No problem. As a GitHub Secret Scanning partner, Zuplo can automatically revoke exposed keys before they can be exploited.

Enable the JWT Service Plugin

Enable the JWT Service Plugin in your Zuplo project. This plugin generates JWTs that your origin API can validate, creating a secure trust relationship between Zuplo and your backend.

modules/zuplo.runtime.ts

 export function runtimeInit(runtime: RuntimeExtensions) {
  // Register the JWT Service Plugin
  runtime.addPlugin(new JwtServicePlugin());
} 

JWT Service Plugin docs

Secure Your Lapis API with JWT Authentication

Configure your Lapis backend to validate the JWTs issued by Zuplo. This ensures that only requests coming through your Zuplo gateway are accepted.

Lua

 local lapis = require("lapis")
local jwt = require("luajwtjitsi")
local httpc = require("http.client")
local cjson = require("cjson")

local app = lapis.Application()

-- JWKS and Issuer
local ISSUER = "https://my-api-a32f34.zuplo.api/__zuplo/issuer"
local JWKS_URI = ISSUER .. "/.well-known/jwks.json"

-- Cache for JWKS
local jwks_cache = nil
local jwks_cache_time = nil

-- Retrieve JWKS data
local function get_jwks()
  local response, err = httpc.get(JWKS_URI)
  if not response then
    return nil, "Failed to fetch JWKS: " .. tostring(err)
  end

  local jwks, decode_err = cjson.decode(response.body)
  if not jwks then
    return nil, "Failed to decode JWKS: " .. tostring(decode_err)
  end

  jwks_cache = jwks
  jwks_cache_time = os.time()
  return jwks
end

-- Get signing key from JWKS
local function get_key(kid)
  if not jwks_cache or os.time() - jwks_cache_time > 600 then
    -- Refresh JWKS cache every 10 minutes
    local _, err = get_jwks()
    if err then return nil, err end
  end

  for _, key in ipairs(jwks_cache.keys) do
    if key.kid == kid then
      return key
    end
  end
  return nil, "Key not found"
end

-- Middleware to validate JWT
local function validate_jwt(req, res)
  local auth_header = req.headers["Authorization"]
  if not auth_header then
    return res:status(401):json({ error = "No token provided" })
  end

  local token = string.match(auth_header, "Bearer (.+)")
  if not token then
    return res:status(401):json({ error = "Invalid authorization header format" })
  end

  local decoded, err = jwt.decode(token, nil, true)
  if not decoded then
    return res:status(401):json({ error = "Invalid token", details = err })
  end

  local key, key_err = get_key(decoded.header.kid)
  if key_err then
    return res:status(401):json({ error = "Invalid token", details = key_err })
  end

  local verified, verify_err = jwt.verify(token, jwt.pkey.from_string(key.x5c[1], "rs256"), { iss = ISSUER })
  if not verified then
    return res:status(401):json({ error = "Invalid token", details = verify_err })
  end

  req.user = decoded.payload
end

-- Example protected route
app:match("/protected", validate_jwt, function(self)
  return {
    json = {
      message = "Access granted",
      user = self.user
    }
  }
end)

return app 

Call Your API Through Zuplo

Now you can call your API through Zuplo using an API key. The request will be authenticated at the gateway, and a JWT will be forwarded to your Lapis backend.

bash

 curl -X GET \
  'https://your-api.zuplo.dev/your-route' \
  -H 'Authorization: Bearer YOUR_API_KEY' 

Ready to secure your API?

Get started with Zuplo for free and add API key authentication to your Lapis API in minutes.

Start for Free Read the Docs