Skip to content
Weik.ioDocs
2026.1
Try Weik.io

This page describes Weik.io 2026.1, and the current release is 2026.2. Read this topic for 2026.2

API Management Overview

Weik.io 2026.1

Manage and secure APIs with Weik.io APIM.

On this page

Weik.io API Management uses a YARP-based reverse proxy to handle traffic. You set up your APIs using three resources: Api (the base path), ApiVersion (the routing rules), and ApiSubscription (the access controls).

Configuration resources#

Api#

The Api resource defines the base URL prefix, the entry point for a specific service.

apiVersion: weik.io/v1alpha1
kind: Api
metadata:
  name: webhook
  description: The Webhook.site TEST API
spec:
  prefix: hook

In this example, the prefix maps to https://your-host/hook/....

ApiVersion#

The ApiVersion tells the proxy where to send the traffic. It uses standard YARP routing syntax.

apiVersion: weik.io/v1alpha1
kind: ApiVersion
metadata:
  name: v1
  description: Webhook.site test using direct forwarding
  category: proxy
spec:
  apiName: webhook
  isActive: true
  connection:
    automaticDecompression: GZip
  parameters:
    routes:
      route:
        clusterId: "cluster"
        match:
          path: "{**catch-all}"
    clusters:
      cluster:
        destinations:
          cluster/destination1:
            Address: "https://webhook.site/99f574f3-a9c3-4723-aae3-ecb98cc4e395"

The parameters section defines the routes and destination clusters, supporting scenarios from direct forwarding to load balancing.

ApiSubscription#

An ApiSubscription determines which callers can access the API. If you do not define one, the API is inaccessible by default.

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: my-apikey
  description: Subscription using X-API-Key header
  category: apikey
spec:
  apis:
    - webhook
  isActive: true
  parameters:
    key: "NGWdkceFPYyXmaH15jS3K0uCsk7KnnPA"

Authentication methods#

Weik.io supports several authentication methods, controlled through the ApiSubscription category.

API key#

The simplest method. Clients pass the key via a header.

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: my-apikey
  category: apikey
spec:
  apis:
    - webhook
  isActive: true
  parameters:
    key: "your-api-key"

Basic authentication#

Username and password over HTTPS.

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: dev-basicauth
  category: basic
spec:
  apis:
    - webhook
  isActive: true
  parameters:
    username: "hello"
    password: "test123"

OpenID Connect (OIDC)#

You can validate tokens from an OIDC provider such as Azure AD or Keycloak.

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: oidc-aad
  category: oidc
spec:
  apis:
    - webhook
  isActive: true
  parameters:
    issuer: "https://sts.windows.net/your-tenant-id/"
    audience: "api://your-api-id"

Anonymous#

To make an endpoint publicly accessible, you still need an ApiSubscription that explicitly allows anonymous access.

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: anonymous-apis
  category: anonymous
spec:
  apis:
    - webhook
  isActive: true

Next steps#