KrakenD

Granular token usage monitoring and enforcement to keep your AI expenses transparent and within budget

Ability to connect endpoints to AI providers and models

Enforce compliance, security, and operational guardrails inline with AI traffic

From isolated authorization flows to data masking and exfiltration prevention

Use Google's Gemini AI without writing custom integration code

Distribute AI requests across one or multiple Large Language Model providers or instances

Use OpenAI's API without writing custom integration code

Route to the right LLM, abstract the request and response interface

Authenticate users with API keys in headers or query strings

Service-to-service authentication using AWS SigV4 service accounts

Authentication of requests based on .htpasswd files

OAuth 2.0 Client Credentials Grant to automatically request access tokens before reaching the backend's protected resources

Service-to-service authentication using Google Cloud service accounts

A wrapper for your existing login endpoint that signs with your secret key the selected fields of the backend payload right before returning the content to the end-user

Authorize tokens coming from third parties or your company identity provider, and apply business logic rules

Mutual TLS authentication (mTLS) for authentication in business-to-business (B2B) applications where clients provide certificates to connect to KrakenD

Support validation of tokens originated in multiple identity providers, internal or external

NT Login Manager Authentication against Windows backends like Microsoft Dynamics

An API to revoke tokens through all KrakenD nodes in a cluster

An RPC listener that allows you to revoke JWT tokens

Write your own Go plugins and side-load them with KrakenD to extend the functionality

With the OpenAPI exporter, you can automatically generate rich documentation websites. Have an OpenAPI? Then, create your API gateway using the OpenAPI specs

Generate Graphviz images displaying your configuration logic

Speed up development with a specific container with hot-reload functionality

Automatic validation as you type, showing documentation while hovering an attribute, explanation of errors, and autocompletion of properties

A visual tool to generate KrakenD configurations

Generate OpenAPI documentation from the KrakenD configuration

Import configurations from OpenAPI + Mocking server generation (Swagger v2 & OpenAPI 3)

Start an API gateway from an OpenAPI definition file

A ready-to-use image to build your custom Go plugins and embed them in KrakenD

A plugin generator that builds all the boilerplate necessary to develop your plugins

Generate Postman collections during the CI/CD stage

Validate configuration files (syntax, linting, route declaration testing)

Create faster interactions with automatic API Composition and aggregation of multiple data sources into a single response

Automatic output encoding and translation (XML, JSON, RSS, noop)

Create an API consumption layer that provides aggregated views of several services and returns only the needed data

Add validation rules to continue with the request or to return the response

Modify the data you return to the end-user, or the payload you send to your services. Filter fields, enrich responses, convert from SOAP, JSON or XML automatically

Filter, group, capture, rename, inject, and more on responses from services

Manipulate arrays and flatten objects from the response

Advanced helpers that run on Go's native implementation rather than Lua for better performance and extended functionality

Transform requests and responses with Lua scripts

Statically transform requests and responses through a simple DSL definition

Modify the response of your services with regular expressions

Craft the body you send to a backend through templates, and injecting other values from the user request such as the original body, headers, querystrings or URL parameters

Completely manipulate the response of a backend using Go templates before it is returned to the end-user

Select, slice, filter, map, project, flatten, sort, and all sorts of operations through a javascript-like query language

Use the output of a previous call to be chained in the next call

Create nested and dependent API consumption to complete a job

Receives all the traffic from routes and methods that do not resolve to any of the other existing endpoints in the configuration

Route requests to one or multiple backends based on request headers or custom policy expressions

Allow the end-user to follow redirects set by services instead of the gateway resolving them

Header and query string processing to assemble the final upstream URL

JSON Web Token processing to assemble the final upstream URL

Proxy requests to a single backend without manipulation and preserving the response as is

Define a set of URLs or regular expressions that are handled by an endpoint

Run different configurations of KrakenD endpoints based on the host accessing the server

Create a single endpoint for a group of URLs sharing a common pattern (e.g.: /foo/*)

Check security and best practices recommendations of your configuration before going live

End-User validation and gateway to service validation: JWT, Client credentials, Oauth2, OpenID, API-Keys, Basic Auth, mTLS

OWASP recommendations that add a frame-breaking strategy

Cross-origin resource sharing

Enables the Cross-site scripting (XSS) filter in the user's browser

Binary with a FIPS 140-2 validated encryption module available

Resist impersonation by attackers using mis-issued or otherwise fraudulent certificates

Web security policy mechanism to protect websites against protocol downgrade attacks and cookie hijacking

Prevent the user's browser from interpreting files as something else than declared by the content type

Define a list of hosts that KrakenD should accept requests to

A powerful engine that evaluates requests, responses and tokens during runtime and allows you to perform business validation logic, ABAC, and RBAC

TLS configuration secured by default to TLS 1.3. Multiple certificates are possible

Explicit configuration for cookie, query-string, and headers forwarding