Docs

Authentication

Zuplo supports API key validation, JWT inbound policies, and OAuth 2.0 token inspection. Auth policies run first inbound and establish identity for downstream rate limiting.

API key authentication

The api-key-inbound policy validates Zuplo-managed API keys in the Authorization: Bearer header. Keys are created and revoked through the Zuplo dashboard or API, and each key links to a consumer identity.

routes.json: api-key-inbound 
{
  "name": "api-key-auth",
  "policyType": "api-key-inbound",
  "options": {
    "allowAnonymous": false  // return 401 if no valid key
  }
}

JWT authentication

Use jwt-inbound to validate JWTs issued by your own auth server. It fetches the JWKS endpoint automatically and refreshes signing keys on rotation.

routes.json: jwt-inbound 
{
  "name": "jwt-auth",
  "policyType": "jwt-inbound",
  "options": {
    "jwksUrl": "$env(JWKS_URL)",
    "algorithms": ["RS256"],
    "audience": "https://api.yourapp.com",
    "consumerIdentityClaim": "sub"  // claim to use as consumer ID
  }
}

Consumer identity mapping

After validation, consumerIdentityClaim supplies the consumer identity for downstream policies. Rate limits, token budgets, and audit logs reference it.

For example, "consumerIdentityClaim": "sub" makes the JWT sub: "user_01j3xa..." the identity, so it is rate-limited separately from other consumers with different sub values.

API key rotation

Revoke a compromised key in the dashboard. Revocation reaches all gateway instances within 30 seconds. Issue the consumer a replacement key with a new expiry.

terminal: rotate key via CLI 
zuplo keys revoke zpk_live_abc123...
zuplo keys create --consumer user_01j3xa --expiry 90d