API Gateway

An open-source, high-performance API gateway built on top of NGINX and designed for hybrid and multi-cloud environments. Kong centralizes authentication, traffic control, and logging through a plugin-based architecture.

• Plugin Hub: Over 200 native plugins for security, transformations, and analytics.
• Declarative Configuration: Supports decK for GitOps-driven gateway management.
• Deployment Modes: Operates in DB-less mode for Kubernetes or with PostgreSQL for traditional setups.
• Anti-Scraping Role: Enforces rate limiting, IP restriction, and bot detection plugins at the ingress point before requests reach upstream services.

A dynamic, real-time API gateway under the Apache Software Foundation that uses etcd as its configuration center, enabling hot-reloading of routing rules without restarts.

• Plugin Orchestration: Supports plugin execution ordering and conditional logic for complex request processing pipelines.
• Multi-Protocol Support: Handles HTTP, gRPC, Dubbo, MQTT, and TCP traffic.
• Built-in Observability: Integrates with Prometheus, SkyWalking, and OpenTelemetry for traffic monitoring.
• Scraping Defense: Leverages traffic splitting and canary release features to isolate and analyze suspicious request patterns without impacting legitimate users.

A fully managed service from Amazon Web Services that makes it easy for developers to create, publish, and secure APIs at any scale. It handles throttling, authorization, and request validation natively.

• Usage Plans: Defines throttling and quota limits per API key, essential for tiered access control.
• AWS WAF Integration: Directly associates Web Application Firewall rules to block SQL injection, cross-site scripting, and known scraper IPs.
• Request Validation: Rejects malformed requests before they invoke backend Lambda functions or HTTP endpoints.
• Caching: Optional API responses caching to reduce origin load during high-volume scraping attempts.

A high-performance C++ distributed proxy designed for single services and applications, serving as the data plane for many service meshes. Envoy provides L3/L4 and L7 filtering with a pluggable filter chain architecture.

• Rate Limiting Service: Integrates with an external rate limit service using a gRPC protocol for global quota enforcement.
• External Authorization: Offloads auth decisions to an external service via the ext_authz filter, enabling custom bot detection logic.
• xDS APIs: Dynamically discovers configuration for listeners, clusters, and routes, allowing real-time rule updates.
• TLS Termination: Enforces mutual TLS (mTLS) to ensure only authenticated services and clients can establish connections.

An API management platform with a lightweight, open-source gateway written in Go. Tyk emphasizes API security and governance with a focus on distributed rate limiting and analytics.

• Distributed Rate Limiter: Uses Redis to synchronize counters across multiple gateway instances, preventing scrapers from bypassing limits by rotating IPs.
• API Blueprint: Supports Open Policy Agent (OPA) for defining fine-grained, code-based access policies.
• URL Rewriting: Dynamically transforms incoming request paths to obfuscate backend service structures from automated reconnaissance.
• Circuit Breaker: Implements a circuit breaker pattern to stop cascading failures if a scraping surge overwhelms backend services.

A hybrid, multi-cloud management platform for APIs across all environments. It combines a gateway, a management plane, and a developer portal with built-in policy expressions for request manipulation.

• Policy Engine: Uses C#-like syntax in XML policies to inspect headers, validate JWT tokens, and enforce IP filtering at the gateway level.
• Named Values: Stores secrets and configuration variables securely, allowing dynamic rate limit thresholds without code changes.
• Virtual Networks: Deploys the gateway inside a VNet for private traffic inspection, isolating backend APIs from public internet scraping.
• Self-Hosted Gateway: Extends Azure's management plane to on-premises and multi-cloud Kubernetes clusters for consistent enforcement.