API Gateway overview
The API Gateway publishes internal workloads—agents, functions, serverless container services, vector databases, Pub/Sub channels, and MemoryStore instances—to secure internet endpoints.
Core capabilities
An endpoint is an internet-facing gateway route pointing to a project resource. Endpoints decouple public access policies (authentication, domain names, rate limits, IP allowlists) from underlying workload runtime behavior.
Endpoint components
| Component | Function | Default Setting |
|---|---|---|
| Name | Endpoint identifier and default URL hostname prefix. | Required |
| Target | Internal workload or data service receiving traffic. | Required |
| Domain | Public hostname (platform-provided domain or custom domain). | Platform domain (*.apps.codyhill.dev) |
| Authentication | Caller identity verification (none, jwt, apikey). | none (Open) |
| IP Allowlist | CIDR network restriction rules. | Unrestricted |
| Rate Limit | Request ceiling per caller per time window. | Unrestricted |
Publishable target types
You can publish endpoints for the following resource types:
- Agents (
agent): Wakes automatically from scale-to-zero on inbound requests. - Functions (
function): Serverless event-driven execution. - Serverless Services (
serverlessorcontainer): Scalable containerized API services. - Vector Database (
vectordb): Managed vector database HTTP API. - Pub/Sub (
pubsub): Project messaging broker endpoint. - MemoryStore (
memorystore): In-memory key-value data instance.
Scale-to-Zero Integration
Publishing an agent, function, or serverless service through the Gateway preserves scale-to-zero behavior. Inbound requests to an idle workload automatically wake up instances to process traffic.
Protection modes
API Gateway provides three distinct authentication modes:
- Open (
none): Publicly accessible endpoint without edge credential checks. Useful for public endpoints, documentation sites, or webhooks verified in application code. - JSON Web Tokens (
jwt): Edge validation for standard OIDC / OAuth2 tokens issued by your identity provider (e.g. Auth0, Okta). - API Keys (
apikey): Gateway-issued API keys sent in theX-API-Keyheader with automatic expiration, rotation, and usage tracking.
Feature comparison
| Feature | Crusoe AI Platform API Gateway | Cloud Provider Gateways |
|---|---|---|
| Deployment Model | Direct one-click publishing | Multi-step API / Stage / Deployment setup |
| Authentication Options | Native Open, OIDC JWT, or Gateway API Keys | IAM, Cognito, Custom Authorizers, API Keys |
| Network Security | Native CIDR IP allowlists | Network ACLs / WAF integrations |
| Traffic Throttling | Built-in per-caller rate limiting | Usage plans and throttling tiers |
| Custom Domains | Automatic TLS certificate provisioning | Custom domain mappings and certificate imports |
Next steps
- Publish an endpoint — Step-by-step guide to deploying public routes.
- Authentication — Configure JWT, API keys, or open access.
- Rate limits — Protect endpoints with request throttling.
- IP allowlists — Restrict access to specific IP CIDR ranges.
- Custom domains — Attach custom domain names with automated TLS.