api gateway as a service · open beta
Instant HTTPS tunnel with API keys and rate limits built in
The developer-first API gateway. A public HTTPS URL, API keys, rate limits, and live request logs in front of any HTTP API, in one command. No YAML, no middleware to write, just your API, live.
- API keys and bearer tokens on any route
- Per-key rate limits enforced at the edge
- Request logs streamed live to dashboard and CLI
Free plan: 1 project, 1,000 requests a day. No credit card required.
Expose and protect your APIs without the overhead
Instant tunneling plus a real gateway: auth, rate limits, logging and production-ready security. From your laptop, a staging box, or a production cluster, one CLI and one dashboard.
Public HTTPS in seconds. No deploy, no config, just code.
What sits between the internet and your API
Every request runs the same chain of checks. Around it, the tools to run an API in production, all on from day one.
every route runs this chain, and you configure nothing to turn it on.
key-auth
API keys on every route
Generate, rotate and revoke keys and bearer tokens. Callers without a valid key never reach your backend.
limit-count
Rate limiting per key
Counted at the gateway, so a leaked key or runaway script cannot flood your API.
http-logger
Every request logged
Method, path, status and latency for each call, streamed live to your dashboard.
tunnel
Localhost to public HTTPS
The CLI gives your local API a stable public URL. Test webhooks, demo, integrate before you deploy.
cors
Browser apps can call it
The gateway answers the browser cross-origin checks, so a web frontend can call your API with no extra backend code.
dashboard
One place to run it
Routes, keys, limits and live logs in one view. No YAML, no gateway to operate.
Live in three commands
Install the CLI
$ curl -L https://dl.apiark.io/apigateway-darwin-arm64 > apigateway && chmod +x apigatewayOne binary, macOS and Linux. Sign up to get your token.
Point it at your API
$ apigateway --token ark_9f3d… --port 3000You get a public HTTPS URL with API key auth, rate limits and logging already on. Production API on a server? Create the route from the dashboard instead, no CLI needed.
Hand out keys, watch traffic
$ curl https://api.apiark.io/fox/orders -H "apikey: ark_…"Callers authenticate with their key. You see every request in the dashboard as it happens.
Built for the week your API meets the outside world
- Receive Stripe or Slack webhooks on your laptop while you build the handler
- Share a staging API with a client or teammate without writing auth first
- Test rate limits and auth flows under realistic conditions
- Bridge frontend and backend without infra blockers
- Run local microservices and expose them behind one gateway
- Put keys and rate limits in front of a production MVP without touching its code
| GET | /fox/orders | 200 | 38ms |
| POST | /fox/orders | 201 | 52ms |
| GET | /fox/orders/1123 | 200 | 29ms |
| GET | /fox/customers | 200 | 44ms |
| POST | /fox/webhooks | 401 | 11ms |
| GET | /fox/orders | 429 | 7ms |
How much work each one is
Every tool here can get you to the same place. The difference is how many steps, config files and moving parts it takes. This is what each one asks of you, not a claim that the others cannot do it.
| What you want | ngrok | Cloudflare Tunnel | Kong / Envoy | ApiArk |
|---|---|---|---|---|
| Public HTTPS URL for a local port | One command | Install daemon, log in, map hostname | Not its job, bring your own tunnel | One command |
| Add API key auth on top | Edit a traffic policy file | Set up Access, issue service tokens | Declare consumer and key-auth plugin | On by default, key issued at signup |
| Per-key rate limit | Policy rule, paid plans | WAF rate limit rule, by IP or path | Plugin config, Redis for multi-node | On by default, counted per key |
| See requests as they happen | Local inspector UI | Dashboard analytics | Wire up a log sink and a dashboard | Live stream in browser and CLI |
| Config files to write | One policy file for auth or limits | Tunnel config plus Access rules | docker-compose plus declarative YAML | None |
| Runs without you hosting anything | Yes | Yes | No, you run the gateway | Yes |
Compared against each product as documented in August 2026. If something here is out of date, tell us at [email protected] and we will correct it.
Works seamlessly with
Node.js, Python, Go, PHP, Rust, Next.js or any HTTP/REST framework.
Why developers love ApiArk
Built for speed
Public HTTPS in seconds, not a sprint.
Zero learning curve
One CLI flag or one dashboard form.
Real testing, no staging pain
The real internet hits your real code.
Protection in one command
Auth, limits and logs, backend untouched.
Frequently asked questions
The things people actually ask before pointing traffic at someone else's gateway.
- Do you inspect or store request bodies?
- No. The gateway proxies over TLS and writes one metadata line per request: method, path, status code, latency and request headers. Bodies are not captured, not inspected and not written to disk. Note that because headers are logged and API keys travel in a header, a key can appear in the gateway log file, so rotate a key if you have reason to.
- Is ApiArk only for localhost, or can I use it in production?
- Both. For local development and webhook testing, run the single-binary CLI tunnel. For an API already on a VPS or cloud host, create the route from the dashboard and skip the CLI entirely. That said, this is an open beta on two gateway nodes run by one person, so size the risk accordingly.
- What happens when a request exceeds limits or fails authentication?
- The gateway answers 401 Unauthorized or 429 Too Many Requests at the edge and drops the request there. Your backend never sees it, so bad traffic costs you no bandwidth and no compute. Rate limit headers come back on every response so a client can see where it stands.
- How much latency does the gateway add?
- The auth check and rate limit counter add a few milliseconds. What dominates your round trip is distance: the gateway nodes sit in Zurich, so a caller in Europe sees far less overhead than one in Asia or the US west coast. Every request shows its measured latency in the live log stream, so you can check the real number for your own setup instead of trusting ours.
- What are the free plan limits?
- One project and 1,000 requests a day, no credit card. When you hit the daily count the gateway returns 429 until the window rolls over.
Ship your API without skipping security
Localhost, staging or production, all behind the same gateway. ApiArk is in open beta: the free plan is the only plan for now, and early users shape what gets built next.
No credit card required. No YAML. Just your API, live.