API management

API management puts a gateway in front of any HTTP API, whether it's an integration you built, your ERP's REST interface or a public API such as Google's. Each consumer gets a subscription with an API key, an OpenID Connect token, basic credentials or a client certificate, with its own rate limit and expiry date. The gateway terminates TLS with certificates the platform obtains and renews, and it logs and traces each request into the integration behind it. Devtest and production answer on their own hostnames, and each has its own keys.

Call the live demo API Read the API docs

Terminal

$ weikio get api-deployments --api invoices
ENVIRONMENT   API                   DEFINITION     GATEWAYS   DEPLOYED BY                 DEPLOYED               STATE
devtest       finance/invoices@v1   3f9a0c1e2b4d   devtest    anna.virtanen@example.com   2026-10-08 09:14 UTC   -
production    finance/invoices@v1   3f9a0c1e2b4d   partners   anna.virtanen@example.com   2026-10-08 09:20 UTC   -

An API in two YAML files

The API finance/invoices and its version v1 put a gateway in front of the ERP's invoice interface. The routes and clusters blocks of the version are YARP's own configuration, and Weik.io adds the hostnames, the subscriptions and the rate limits around them.

finance/apis/invoices/api.yaml

apiVersion: weik.io/v1
kind: api
metadata: { name: invoices, project: finance }
spec: { displayName: Invoice API, prefix: /invoices }

finance/apis/invoices/v1.yaml

apiVersion: weik.io/v1
kind: api-version
metadata: { name: v1, project: finance, api: invoices }
spec:
  type: proxy
  rateLimit: { permitLimit: 600, window: 1m }
  routes:                                   # YARP RouteConfig, verbatim
    - RouteId: pending
      Match: { Path: "/{**rest}" }
      ClusterId: erp
  clusters:                                 # YARP ClusterConfig, verbatim
    - ClusterId: erp
      LoadBalancingPolicy: RoundRobin
      Destinations:
        erp: { Address: "{{erp-url}}/api/invoices" }

Terminal

$ weikio apply -f ./finance/apis/
Target: https://hub.example, project finance (from finance/project.yaml)
api finance/invoices created
api-version finance/invoices@v1 created (type proxy, rate limit 600/1m)

$ weikio api deploy finance/invoices@v1 --env production
Target: https://hub.example, project finance (argument), environment production (--env)
This will deploy 'finance/invoices@v1' to production environment 'production' on the default gateways.
Continue? [y/N] y
api-deployment production/finance/invoices@v1 created (gateways partners, definition 3f9a0c1e2b4d, revision 31)
Served at https://api.example.com/invoices/v1 (gateway partners).

$ weikio subscription create finance/partner-x --env production --api invoices --type apikey --rate-limit 60/60s
Target: https://hub.example, project finance (from finance/project.yaml), environment production (--env)
api-subscription production/finance/partner-x created (gateway partners, type apikey, APIs invoices, rate limit 60/1m)

To rotate the key later:
  weikio subscription rotate-key finance/partner-x --env production

API key (shown once): ****************************************

$ curl -i -H "X-Api-Key: $PARTNER_KEY" https://api.example.com/invoices/v1/pending
HTTP/2 200
content-type: application/json
traceresponse: 00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01

What the gateway does

In front of any HTTP API

The gateway fronts your integrations, your own services and third-party APIs. Calls to the upstream can carry headers, basic credentials or an OAuth client-credentials token, which the gateway fetches and caches.

Docs: Upstreams and routes

Subscriptions and keys

A subscription accepts an API key, a key in the query string, basic credentials, an OpenID Connect token, a client certificate or anonymous calls, and it has an owner and an expiry date. Keys are stored only as a hash, shown once and rotated with weikio subscription rotate-key.

Docs: Subscriptions and rate limits

Rate limits

You set rate limits per API version, per subscription and per caller on a gateway, each as a number of calls in a time window such as 600 a minute.

Docs: Subscriptions and rate limits

Hostnames per environment

The same gateway serves api.example.com for production and api-test.example.com for devtest, and each environment has its own subscriptions and keys.

Docs: Gateways and hostnames

Gateways at your sites

A gateway can listen only on a site's own network. Partners reach an API at a factory through the hub, and no port is opened at the site.

Docs: Gateways at sites

Webhooks

The gateway stores each request body in a channel before the caller gets its answer. The caller's headers travel with the body, and an integration can check the provider's signature from them.

Docs: Webhooks

Certificates

The platform obtains and renews certificates from Let's Encrypt, with DNS challenges through Cloudflare, Hetzner, Azure or RFC 2136. You can also use your own ACME authority, the platform's own authority for internal names or an uploaded certificate.

Docs: Certificates

Every call recorded

The Requests page lists each call with its version, subscription, route and status, and it separates failures on the gateway's side from failures on the caller's side. Each response carries a traceresponse header, and weikio trace or the admin UI opens the call's trace from its value.

Docs: Watching the calls

YARP's own configuration

The routes and clusters blocks of a version are YARP's configuration as it is, and YARP's documentation applies to them.

Docs: Upstreams and routes

One call, start to end

A partner's call reaches the gateway, which checks the subscription and the rate limit before it forwards the call to the upstream. The trace follows the call into the integration behind the API.

Watch the calls

Each API has its own Requests, Subscriptions and Metrics pages in the admin UI, and Settings shows the gateways with their hostnames per environment.

The Requests page of the invoices API in production with filters, a chart of calls and one row for each call from the subscriptions ap-portal, partner-x and partner-y — Requests has one row for each call through the gateway, with the subscription, the path, the status and the time it took, and each row opens the trace of the call.

The gateway on a laptop

On a laptop the gateway runs alone on plain HTTP. weikio-backend init --dev creates the environment devtest with a gateway that answers on localhost, and you can deploy an API, create a subscription and call it with curl right after the install. The same rules as a hub gateway, including allowed networks and client certificates, apply on the laptop.

Read the laptop guide

API management track

Four short videos go from publishing an API and calling it to receiving webhooks.

APIM 1 · 3:25 Publish an API and call it

APIM 2 · 3:08 Open it to a caller: a key and a limit

APIM 3 · 3:14 Watch the calls

APIM 4 · 3:08 Webhooks

See all API videos

Questions

Can it front an API that isn't built in Weik.io?

The gateway fronts any HTTP API, including your ERP's REST interface and public APIs such as Google's.

Where do consumers get their keys?

Your team creates each key in the admin UI or with the weikio CLI and gives it to the consumer. A key is shown once, and Weik.io stores only its hash.

Does the gateway keep serving if the backend is down?

The gateway keeps serving with the last configuration it received, and new changes reach it when the backend is back.

Can a devtest key open a production API?

A devtest key doesn't open production APIs, because each environment answers on its own hostnames and has its own subscriptions and keys. The security page lists the sign-in, network and audit controls of the whole installation.

Is Weik.io open source?

Weik.io is open source under the Apache License 2.0 and runs on your own servers, in your cloud or in Weik.io Cloud.

Call the live demo API

One curl from your terminal shows up in the live demo's Requests page with its trace.

Call the live demo API Read the API docs