API management

API management puts a gateway in front of any HTTP API, whether it's an integration you built, your ERP's REST interface or a public API such as Google's. Each consumer gets a subscription with an API key, an OpenID Connect token, basic credentials or a client certificate, with its own rate limit and expiry date. The gateway terminates TLS with certificates Weik.io obtains and renews, logs each request and follows it with a trace into the integration behind the API. Devtest and production answer on their own hostnames, and each has its own keys.

Call the live demo API Read the API docs

Terminal

$ weikio get api-deployments --api invoices
ENVIRONMENT   API                   DEFINITION     GATEWAYS   DEPLOYED BY                 DEPLOYED               STATE
devtest       finance/invoices@v1   3f9a0c1e2b4d   devtest    anna.virtanen@example.com   2026-10-08 09:14 UTC   -
production    finance/invoices@v1   3f9a0c1e2b4d   partners   anna.virtanen@example.com   2026-10-08 09:20 UTC   -

An API in two YAML files

In the example project finance, the API invoices puts a gateway in front of the ERP's invoice interface. Its first file gives the API a name and a path, and its version v1 sends the calls on to the ERP with a rate limit of 600 calls a minute.

finance/apis/invoices/api.yaml

apiVersion: weik.io/v1
kind: api
metadata: { name: invoices, project: finance }
spec: { displayName: Invoice API, prefix: /invoices }

finance/apis/invoices/v1.yaml

apiVersion: weik.io/v1
kind: api-version
metadata: { name: v1, project: finance, api: invoices }
spec:
  type: proxy
  rateLimit: { permitLimit: 600, window: 1m }
  routes: # YARP RouteConfig, verbatim
    - RouteId: pending
      Match: { Path: "/{**rest}" }
      ClusterId: erp
  clusters: # YARP ClusterConfig, verbatim
    - ClusterId: erp
      LoadBalancingPolicy: RoundRobin
      Destinations:
        erp: { Address: "{{erp-url}}/api/invoices" }

Terminal

$ weikio apply -f ./finance/apis/
Target: https://hub.example, project finance (from finance/project.yaml)
api finance/invoices created
api-version finance/invoices@v1 created (type proxy, rate limit 600/1m)

$ weikio api deploy finance/invoices@v1 --env production
Target: https://hub.example, project finance (argument), environment production (--env)
This will deploy 'finance/invoices@v1' to production environment 'production' on the default gateways.
Continue? [y/N] y
api-deployment production/finance/invoices@v1 created (gateways partners, definition 3f9a0c1e2b4d, revision 31)
Served at https://api.example.com/invoices/v1 (gateway partners).

$ weikio subscription create finance/partner-x --env production --api invoices --type apikey --rate-limit 60/1m
Target: https://hub.example, project finance (argument), environment production (--env)
api-subscription production/finance/partner-x created (gateway partners, type apikey, APIs invoices, rate limit 60/1m)

To rotate the key later:
  weikio subscription rotate-key finance/partner-x --env production

API key (shown once): ****************************************

$ curl -i -H "X-Api-Key: $PARTNER_KEY" https://api.example.com/invoices/v1/pending
HTTP/2 200
content-type: application/json
traceresponse: 00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01

What the gateway does

In front of any HTTP API

The gateway fronts your integrations, your own services and third-party APIs. Calls to the upstream can carry headers, basic credentials or an OAuth client-credentials token, which the gateway fetches and caches.

Docs: Upstreams and routes

Subscriptions and keys

A subscription accepts an API key, a key in the query string, basic credentials, an OpenID Connect token, a client certificate or anonymous calls, and it has an owner and an expiry date. Keys are stored only as a hash, shown once and rotated with weikio subscription rotate-key.

Docs: Subscriptions and rate limits

Rate limits

You set rate limits per API version, per subscription and per caller on a gateway, each as a number of calls in a time window such as 600 a minute.

Docs: Subscriptions and rate limits

Hostnames per environment

The same gateway serves api.example.com for production and api-test.example.com for devtest, and each environment has its own subscriptions and keys.

Docs: Gateways and hostnames

Gateways in your own network

A gateway can listen only on your own network. Partners reach an API at a factory through Weik.io, and no port is opened at the factory.

Docs: Gateways at sites

Webhooks

The gateway stores each request body in a channel before the caller gets its answer. The caller's headers travel with the body, and an integration can check the provider's signature from them.

Docs: Webhooks

Certificates

The platform obtains and renews certificates from Let's Encrypt, with DNS challenges through Cloudflare, Hetzner, Azure or RFC 2136. You can also use your own ACME authority, the platform's own authority for internal names or an uploaded certificate.

Docs: Certificates

Every call recorded

The Requests page lists each call with its version, subscription, route and status, and it separates failures on the gateway's side from failures on the caller's side. Each response carries a traceresponse header, and weikio trace or the admin UI opens the call's trace from its value.

Docs: Watching the calls

YARP documentation applies

Everything in routes and clusters is YARP's configuration as it is, so the YARP documentation covers it, from path matching to load balancing.

Docs: Upstreams and routes

One call, start to end

A partner's call reaches the gateway, which checks the subscription and the rate limit before it forwards the call to the upstream. The trace follows the call into the integration behind the API.

The integration runs on one of your agents.

Watch the calls

Each API has its own Requests, Subscriptions and Metrics pages in the admin UI, and Settings shows the gateways with their hostnames per environment.

The Requests page of the invoices API in production with filters, a chart of calls and one row for each call from the subscriptions ap-portal, partner-x and partner-y — Requests has one row for each call through the gateway, with the subscription, the path, the status and the time it took, and each row opens the trace of the call.

The gateway on a laptop

On a laptop the gateway runs alone on plain HTTP. weikio-backend init --dev creates the environment devtest with a gateway that answers on localhost, and you can deploy an API, create a subscription and call it with curl right after the install. Allowed networks and client certificates work there as on any installation.

Read the laptop guide

API management track

Four videos go from publishing an API and calling it to receiving webhooks.

APIM 1 · 3:55 Publish an API and call it

APIM 2 · 3:28 Open it to a caller: a key and a limit

APIM 3 · 3:33 Watch the calls

APIM 4 · 3:09 Webhooks

See all API videos

Questions

Can it front an API that isn't built in Weik.io?

Yes, the upstream can be any HTTP address the gateway reaches, inside your network or on the internet.

Where do consumers get their keys?

Your team creates each key in the admin UI or with the weikio CLI and gives it to the consumer. A key is shown once, and Weik.io stores only its hash.

Does the gateway keep serving if the backend is down?

The gateway keeps serving with the last configuration it received, and new changes reach it when the backend is back.

Can a devtest key open a production API?

A devtest key doesn't open production APIs, because each environment answers on its own hostnames and has its own subscriptions and keys. The security page lists the sign-in, network and audit controls of the whole installation.

Is Weik.io open source?

Yes, Weik.io is open source under the Apache License 2.0 and runs on your own servers, in your cloud or in Weik.io Cloud.

Call the live demo API

A curl from your terminal shows up in the live demo's Requests page with its trace.

Call the live demo API Read the API docs