API GatewayComing soon · Security Platform

One auth + key-management plane for every product you ship.

Register a downstream API once, then mint, scope, rate-limit, IP-restrict, expire, hot-rotate, and revoke per-customer keys from a single UI. Every key validation lands in the audit trail with full context — caller IP, scope claimed, rate-limit decision, latency.

Get a demoRead the docs
Federation hub with keys flowing between products and customers in indigo and lime.

Why this is its own pillar

The auth + key plane shouldn't be three vendors.

Most teams stitch a routing-tier API gateway, an edge-tier rate-limiter, and a homemade key-management UI for customer self-service. Three products, three audit logs, three places where a leaked key needs to be revoked. Tessarac collapses that slice into one — the routing layer can stay where it is; the auth + keys + audit comes home.

  • Per-customer API keys with scopes, rate limits, expiration, and IP allowlists
  • Hot rotation with overlapping validity windows — customers can rotate without downtime
  • Per-key usage analytics — calls/sec, p95 latency, error rate, top endpoints, top errors
  • Customer-facing self-service UI — your customers create, scope, rotate, and revoke their own keys
  • Operator-defined per-product environments (production, staging, dev, test, beta) — split UI views by env without affecting the bill

The plane composes for any API shape

M2M tokens for service-to-service, customer-app keys for customer-to-API, OIDC client credentials for the OAuth-shaped world. One audit log, one scope model, one revocation surface.

  • Single sign-on federation hub with token issuance flows.

    M2M (service-to-service)

    Issue OAuth client-credentials tokens for inter-service auth. Same scope and audit model as customer-facing keys. Tokens auto-rotate on schedule with overlapping validity windows so callers never see a 401.

  • Role-based access control surface with policy gates.

    Customer-to-API

    Per-customer API keys minted by your customer's admin from the hosted UI. Scoped, rate-limited, IP-restricted. Customers see their own usage analytics; you see the aggregate.

  • Secrets vault with active rotation surfaces.

    Hot rotation + webhook hooks

    Rotate any key without breaking integrations. Outbound webhooks fire on create / rotate / revoke / expire so your downstream systems can react. Two overlapping keys are valid until you cut the old one.

  • Append-only audit trail with hash-chained block visualization.

    Audit + introspection

    RFC 7662 token introspection endpoint for resource servers. Every validation hits Tessarac and lands in the audit trail. Customer-visible audit per tenant; operator-visible audit across the platform.

What we replace

The auth + keys + customer-facing UI part of your stack — not the routing.

Tessarac is not a layer-7 proxy. We deliberately do the part that's painful (auth + keys + customer self-service + audit) and leave the part that's not (routing) to whatever you already use. Keep your existing API gateway, edge proxy, or service mesh. Plug Tessarac into the auth side.

  • Reference integrations published for every major gateway, edge proxy, and service mesh
  • RFC 7662 introspection — your gateway hits Tessarac, gets back claims + scope + rate-limit decision in <5ms p99
  • Sub-cent per-validation cost; no per-API-call gateway markup
  • Backed by the same audit trail, RBAC model, and tenant isolation as the rest of Tessarac

One auth plane. Every product. Every customer.

Pull the auth + key + audit slice out of three vendors and into one. Your API keys stop being a back-office spreadsheet.

Get a demoRead the docs