APIs Have Outgrown the Gateway
The Internet no longer resembles the static collection of pages it once was. Applications today exchange rich data continuously—workout trackers sync to the cloud, smart locks await commands, and social platforms stream updates. All of that interactivity runs on APIs, and every request must be monitored and authenticated.
That burden usually falls to a dedicated API gateway provider. But the traditional model has weaknesses: cost, added latency, and the privacy exposure that comes from routing more than half of all Internet traffic through a third party. Cloudflare's answer is the API Gateway, a single package built on the company's existing edge products that aims to replace incumbent gateways at lower cost and with more capable tooling.
The service combines three tiers of functionality:
- Security: Discovery, Schema Validation, and Abuse Detection are now generally available.
- Management & Monitoring: Analytics, routing, and authentication build on Cloudflare Access and related infrastructure.
- Everything Else: SSL/TLS termination, load balancing, and proxy services run by default.
Discovery
Before you can secure an API, you need to know it exists. Discovery builds an exhaustive inventory of endpoints by inspecting traffic passed through Cloudflare's network. In the dashboard, you activate the feature and specify how to identify API traffic—a header works today, with body- and cookie-based identification on the way.
The resulting list includes each method, path, and supporting metadata. Endpoints containing variables are collapsed into general forms (e.g., /account/{var1}), giving you an accurate picture of your surface area. Customers frequently discover the reality is larger than expected—finding over 100 active endpoints where they assumed 30.
Schema Validation
If you maintain an OpenAPI schema, Cloudflare will validate incoming requests against it and reject nonconforming traffic before it reaches your origin. Upload the schema, choose the enforcement action, and deploy. Schema Validation is already protecting major crypto exchanges, delivery services, and payment platforms; body validation will arrive later.
Abuse Detection
Schema validation stops malformed requests, but well-formed abusive traffic needs a different defense. As Discovery maps your endpoints, Cloudflare suggests rate limits tuned to each one. The algorithm learns normal usage patterns—say, one weather check every 10 minutes per user—and flags outliers that hammer the endpoint 37 times in the same window. Recommended thresholds are weighted to preserve a buffer for legitimate users while cutting off scrapers.
The feature integrates with the Advanced Rate Limiting engine, letting you fine-tune with cookies, headers, and more. Cloudflare has dogfooded Abuse Detection on api.cloudflare.com for months. It uses the same machine learning approach as Bot Management, and it's available now. A companion feature—Sequential Abuse Detection for anomalous request flows—remains in early access.
Mutual TLS
For device ecosystems, mTLS provides a positive security model: install a client certificate on each legitimate device, and Cloudflare validates it on every request. Consider a weather service with an endpoint that accepts temperature readings from remote thermometers. Without mTLS, anyone can submit fake data. With it, only devices bearing the right certificate get through.
Cloudflare already issues a set of free certificates to every customer. API Gateway customers now receive unlimited certificates by default.
Authentication
APIs commonly rely on authentication to enable sessions, protect personal data, and manage infrastructure. Cloudflare's gateway takes an active role by issuing and validating API keys, JSON web tokens, and OAuth 2.0 tokens, with access control lists for managing permissions across user groups.
The key advantage is architectural. Traditional gateways often send authentication requests to an external identity provider, adding latency and forcing data to travel outside the Cloudflare ecosystem. Cloudflare performs the validation on its global network, handling requests in a fraction of the time. The technology is ported from Cloudflare Access, which already handles identity provider integration for internal applications. Unlimited authentication and token exchange will be available soon.
Routing and Microservices
Modern applications are often decomposed into microservices—separate teams own different functions, but all of them sit behind a single public entry point. That entry point, traditionally an API gateway, routes each request to the correct service.
Cloudflare's gateway performs this routing with Transform Rules, dynamically rewriting and redirecting traffic at the edge. Configuration is straightforward and deployment is fast, eliminating the need for a standalone routing service.
The gateway can go a step further and replace microservices entirely through Cloudflare Workers. A Worker might return hotel prices stored in Durable Objects on Cloudflare's network. Requests arrive at the edge, are routed by Transform Rules, and are served by Workers—all without leaving the Cloudflare infrastructure. Workers can still contact your origin when necessary, and the integration will be available soon.
API Analytics
Visibility often matters as much as enforcement. API Analytics draws on Cloudflare's existing products to present real-time data: popular endpoints, machine-learning-driven insights, abuse threshold histograms, and usage trends.
Exportable custom reports and organizational sharing will follow when the feature launches.
Logging, Quotas, and the Rest
Established Cloudflare features—caching, load balancing, and log integrations—work natively with the API Gateway, delivering latency benefits without extra configuration. Enterprise Logs will expand to handle real-time logging, capturing each user who accesses an API and tracking every request through its full lifespan: received, validated, routed, and answered.
Quota Management is also in development, counting requests over longer windows such as a month and letting you set user thresholds. For more sophisticated enforcement, Advanced Rate Limiting already handles cases including GraphQL body inspection.
What's Available Today
Cloudflare’s API security features are now generally available to all Enterprise customers. These tools — API Discovery, Schema Validation, Abuse Detection, and mTLS — form the core of what Cloudflare calls API Shield. They function as the protective layer for the broader gateway functionality that is still rolling out.
Enterprise customers can request access to these security features through their account teams immediately.
Early Access and the Road Ahead
Beyond the security layer, most other API Gateway components are currently in early access. Cloudflare points to industry research highlighting the scale of the problem: according to Gartner, by 2025 less than half of enterprise APIs will be under active management, as API growth outpaces traditional management tooling.
The stated goal is to provide an API gateway that is affordable enough to counter that trend. Engineering teams that want to evaluate specific gateway features can reach out to their account team to get onboarded into early access as capacity allows.
