Feature — Authentication

Centralized Auth for Every API

Support every auth method your teams need — from legacy Basic Auth to modern OAuth 2.0 — configured per service and route, not per codebase.

Six Methods. One Control Plane.

apiRuler centralizes all authentication at the gateway layer. Backend services receive only authenticated, authorized requests — no duplicated auth logic across services.

  • JWT — Stateless token verification with RS256/HS256 and configurable claims
  • OAuth 2.0 — Authorization Code, Client Credentials, and Implicit grant flows
  • API Key — Key-based access with consumer-level rate limiting and scopes
  • HMAC — Hash-based message authentication for high-security integrations
  • Basic Auth — Username/password compatibility for legacy systems
  • LDAP — Enterprise directory integration with Active Directory support
API security and authentication

Keycloak User Management — Built In

apiRuler includes full Keycloak integration for enterprise identity management. Manage users, roles, and permissions from the admin GUI — no separate identity server setup required.

User & Group Management

Create, update, and manage users and groups directly from apiRuler’s admin GUI via Keycloak.

Role-Based Access Control

Define fine-grained RBAC policies. Assign roles to consumers and enforce them at the gateway level.

SSO & OIDC Ready

Single Sign-On support via OIDC and SAML for seamless enterprise authentication flows.

Ready to Centralize Authentication?

Configure auth once at the gateway — apply it to every service without touching your code.