Security
API Security
Secure access to the APIs your organisation consumes — not just the ones you expose. Add authentication, access control, metering, and response filtering to any third-party or internal API without touching the upstream.
Overview
Gateway Security Architecture
RequestRocket sits between your callers and any upstream API. Every request is authenticated, authorized, and metered before being forwarded. Every response is filtered before it reaches the caller. Nothing changes on the upstream — no code, no configuration, no credentials shared.
Inbound protection
Every caller must authenticate before any request logic runs. Proxy credentials support API key, bearer token, Basic auth, JWT string, JWT verification via JWKS, and OAuth 2.0 access tokens. Unauthenticated requests are rejected with a 401 Unauthorized before they reach your upstream.
Outbound governance
After authentication, rules gate which requests are forwarded, meters enforce usage quotas, and filters redact sensitive fields from responses before they reach the caller. Your upstream secret is injected by RequestRocket — callers never see it.
Security
What Gets Enforced on Every Request
Authentication
Caller identity is validated against the proxy credential before any other logic runs. A single proxy can issue credentials to multiple callers with different auth methods. Failed authentication short-circuits the pipeline and returns a 401 immediately.
Access Control
Regex-based allow and deny rules match on HTTP method, path, headers, query parameters, and request body. Rules attach to the proxy, target, proxy credential, or target credential — all four layers must allow before a request is forwarded.
Authorization →Metering & Quotas
Meters enforce per-proxy limits across minute, hour, day, and month windows. Requests that exceed an active meter return a 429 Too Many Requests with a Retry-After header. Client-level counters track usage independently without blocking traffic.
Response Redaction
Filters run on 2xx JSON responses and apply retain or destroy operations on JSON paths before the response reaches the caller. Filters stack across four layers — target credential, target, proxy credential, proxy — giving you fine-grained control over what each caller sees.
Data Redaction →Deployment
Works for Every API Pattern
Whether you're securing access to SaaS APIs your team consumes or adding a governance layer in front of internal systems, RequestRocket adapts to your network topology.
APIs you consume
Secure access to third-party SaaS and partner APIs. The upstream secret — API key, OAuth token, or Basic credentials — is stored encrypted in RequestRocket and injected on every forwarded request. Your callers authenticate against the proxy credential and never see the upstream secret.
APIs you host internally
Deploy the data plane inside your own VPC so it can reach legacy systems and on-prem APIs that are never exposed to the internet. The control plane manages configuration remotely — no changes required on the upstream service.
Contact us →Use Cases
Common API Security Scenarios
Practical patterns for securing outbound API access — from partner integrations to legacy system facades.
Add outbound API security
without changing code
Start on your own or talk to our team about improving the security of every API call you make.