Serverless API Gateway

Open-source API gateway on Cloudflare Workers. Config-driven routing, JWT auth, Auth0, CORS, service binding, and variable mapping at the edge.

Introduction

The Serverless API Gateway is a globally distributed, Cloudflare Workers–powered solution that simplifies how you manage and secure your APIs. Whether you’re stitching together multiple microservices or transforming requests on the fly, this gateway brings crucial features—routing, CORS, authentication, service binding, and more—into a single, lightweight tool.

Goals and Motivation

Modern applications rely on APIs for data exchange, yet securing and organizing these APIs can be a headache. Traditional reverse proxies or monolithic API gateways often require complex setups, dedicated servers, or costly managed solutions. The Serverless API Gateway emerged to address these pain points:

• Security at the Edge: Enforce JWT-based authentication or integrate with Auth0, ensuring only valid requests pass through.

• Simple, Config-Driven Routing: Avoid sprawling or duplicated routing logic. Define paths in a JSON file and let the gateway do the heavy lifting.

• Global Reach, No Servers: Because it’s built on Cloudflare Workers, your APIs are served from Cloudflare’s edge network—no server upkeep required.

• Adaptable for Microservices: Tightly couple front-end routes to multiple backends or Worker services in one place, reducing architectural complexity.

• Cost-Effective: Only pay for the Cloudflare Workers usage (with a generous free tier), bypassing the overhead of maintaining dedicated gateways.

Where It Fits in Your Architecture

In a typical microservices environment, each service (e.g., Users, Payments, Notifications) might be deployed separately. The Serverless API Gateway sits in front of these services:

[ Client / Frontend ]
           |  (API calls)
           v
  ┌───────────────────────────────────┐
  │  Serverless API Gateway (Worker) │
  │   - Routing & Path Matching      │
  │   - CORS & Auth                  │
  │   - Request Transformation       │
  │   - Service Binding (Workers)    │
  └───────────────────────────────────┘
           |
           v
 [ Users Service ]   [ Payment Service ]   [ External API ]  ...

• Client: Sends HTTP requests to a single gateway URL (e.g., my-api.example.com).

• Gateway (this project): Matches each request to a route, applies JWT or Auth0 checks, transforms headers/queries if needed, and proxies/calls the correct backend.

• Backend Services: Focus solely on business logic—relying on the gateway to handle cross-cutting concerns like authentication and cross-origin allowances.

By centralizing these features at the Worker layer, you can unify your security model and reduce the boilerplate in downstream microservices.

Key Features at a Glance

• JS Workers: Write serverless JavaScript Workers that intercept and modify your API requests and responses on the fly.

• Routing (Path and Method): Simplify your API architecture with flexible path and method-based routing for directing traffic to the appropriate endpoints.

• Service Binding: Bind your API to a service as Workers, so you can use the Workers capabilities within your API.

• CORS: Manage cross-origin resource sharing settings with ease, ensuring your APIs can securely handle requests from different origins.

• Authentication (JWT): Secure your APIs by implementing JSON Web Token (JWT) based authentication to validate and manage user access efficiently.

  • JWT: Validate tokens using a shared secret (HS256) or RS256 with Auth0’s JWKS.

  • Supabase OTP: Optionally integrate phone/email OTP flows if you’re using Supabase.

  • Auth0 Authentication: This service offers reliable identity management by simplifying user authentication. It supports multiple providers, ensuring secure, easy integration for developers and users.

• Variable Mapping: Map variables from sources to destinations, allowing you to easily transform your data.

How It Differs from Traditional Solutions

• No Dedicated Infrastructure: Everything runs on Cloudflare’s edge, eliminating the typical overhead of provisioning servers or VMs for a gateway.

• Fine-Grained Control at the Edge: Because it’s serverless code, you can place custom logic right where requests arrive, with extremely low latency.

• Pay-as-You-Go: Unlike many managed API gateways that charge flat monthly fees or have complex pricing tiers, this leverages Cloudflare’s usage-based model (often free for small workloads). See the cost breakdown for real-world pricing estimates.

• Easier Microservice Integration: You can tie multiple backends or even other Cloudflare Workers to a single, config-driven gateway, rather than chaining or deploying separate proxies.

Next Steps

• Review the full Configuration Guide to set up routing, CORS, and authentication.

• Follow the Getting Started instructions to clone, configure, and deploy.

• Deploy to Cloudflare Workers using Wrangler or GitHub Actions.