Describe the API
Upload an OpenAPI JSON contract. It is quarantined, malware-scanned, validated, and indexed.
SELF-HOSTABLE API GATEWAY
Put one governed endpoint in front of every API.
RLX Gate is a control plane for Envoy. Connect a backend, define exactly which traffic can reach it, and deploy a signed configuration your applications can call immediately.
Real reverse proxy Isolated routes Safe rollback
Traffic pathEnvoy data plane
Application
POST /ordersgateway.example.comOrders route
Host + path matchOnly the intended API receives traffic
Traffic controlsMethods, timeout, and rate limit
Signed configurationRevision can be rolled back
Backend serviceapi.internal.example
Route activeRequest ID forwarded end to end
ONE CONTROL SURFACE, ONE REQUEST PATH
Understand the system before you put traffic through it.
RLX Gate keeps management decisions off the hot path while Envoy enforces the verified result at the edge of your APIs.
Control plane
OPERATORSPolicies & routes
SIGNEDVerified revision
Data plane
CLIENTSApps & agents
RLX GATEIdentity & policy
ENVOYRoute traffic
ORIGINSBackend APIs
Envoy keeps serving the last verified revision if the management console is unavailable.
FROM BACKEND TO GATEWAY URL
Get an API behind the gateway without learning the internals first.
The control plane turns four operator decisions into a verified Envoy configuration.
Connect the backend
Add the HTTP or HTTPS service that should receive requests, including health-check targets.
Define the public route
Choose the gateway hostname, base path, HTTP methods, timeout, and requests-per-second limit.
Review and deploy
Create a signed configuration revision, publish it to Envoy, or return to an earlier revision.
DESIGNED AROUND THE REQUEST PATH
See what sits between your application and its backend.
The useful unit is not a log line. It is a managed traffic path: a public hostname and route, the controls applied there, the backend targets, and the revision currently serving it.
- Keep client-facing URLs separate from backend locations.
- Limit methods, request rate, and time spent waiting upstream.
- Trace every administrative change through deployment and rollback.
Clients callgateway.example.com/orders
hostname + path + method
Gateway controlsRoute · timeout · rate limit
Signedrequest ID + proxy headers
Backend receivesapi.internal.example
WHAT THE FOUNDATION DOES TODAY
The core middleware lifecycle is real—not a decorative dashboard.
Request routing
Match a hostname, path prefix, and allowed HTTP methods, then forward traffic to healthy weighted targets.
Traffic controls
Enforce route-specific timeouts and local rate limits in the Envoy data plane.
Controlled delivery
Compile deterministic, signed revisions with explicit publish history and rollback.
RUN IT WHERE YOUR APIS LIVE
A separate control plane and data plane, without a Kubernetes requirement.
The Go control plane manages tenant configuration. Envoy stays on the request path and keeps serving the most recently verified configuration if the console is unavailable.
ApplicationsEnvoy gatewayBackend APIsSigned configuration is delivered out of band by the control plane.
CLEAR PRODUCT BOUNDARIES
Evaluate what is implemented now—and what is still being built.
Available now
Gateway foundation
- OpenAPI 3.0 and 3.1 JSON import with quarantine scanning
- Hostname, path, method, timeout, and local rate-limit routing
- Multiple weighted backend targets with active health checks
- API-key and JWT/OIDC application identity with fail-closed authorization
- Operator-managed API products, client subscriptions, plan rates, and durable quotas
- CORS, source-network, and request-header policies attached per route
- Versioned route and backend lifecycle with persisted traffic telemetry
- Signed Envoy configuration revisions, deployment history, and rollback
- Organization, workspace, environment, project, team, and role boundaries
- Tamper-evident administrative audit history
In active development
Full API management
- Schema validation, body transformation, WAF, and a broader policy catalog
- Distributed traces, anomaly detection, and upstream health history
- Developer self-service, published catalogs, documentation portals, and API usage billing
- Multi-provider AI routing, MCP authorization, and agent approvals
STRAIGHT ANSWERS
Know what you are putting on the request path.
Does RLX Gate proxy real application traffic?
Yes. Applications call the Envoy data-plane endpoint, which matches a deployed hostname, path, and method before forwarding the request to the configured backend target.
Does it require Kubernetes?
No. The current topology is designed to run with Docker Compose on a single VPS. Broader cluster and hybrid fleet management remain future work.
Are API security policies and traffic analytics available?
Yes, for the implemented core: API-key and JWT/OIDC identity, per-route auth, CORS, source-network and request-header controls, product subscription rate and quota enforcement, plus persisted request summaries and privacy-minimized events. Schema validation, body transformation, distributed tracing, anomaly detection, and a developer portal remain future work.
How does console access work?
Registration is approval-gated. Approved users create a user-verifying passkey from a single-use activation link.
START WITH ONE TRAFFIC PATH