API management for platform teams

Ship APIs, not gateway plumbing.

Centiceps is one self-hosted product for publishing APIs, adding guardrails, managing who can call them, and running the gateways.

Start locally Explore the platform

Policies, consumer identity, deployments, and day-to-day operations. One product.

One policy layer for every service

Every service gets the same protection.

Why Centiceps

Give every API team a paved road. Don't force every service into one codebase.

Platform teams own the shared guardrails. API teams keep shipping their own services.

One working model

The routine API work, handled once.

Every service needs the same things: auth, limits, logging, a way to deploy. Centiceps does them once, so each team doesn't rebuild them.

Publish with confidence

Keep the API contract together

Routes, targets, policies, and scripts ship as one versioned bundle.

Govern consistently

Apply guardrails across teams

Reuse auth, rate limits, retries, and protection. No custom middleware per service.

Operate one estate

See changes and runtime status

Environments, consumers, deployments, and gateway health in one place.

Built for the handoffs

One platform. Three teams. Less friction.

Platform engineering

Offer a paved road for publishing and running APIs, without owning every release.

Security

Turn access and traffic rules into reusable policy that everyone can see.

API owners

Ship changes, onboard consumers, and debug behavior without building gateway tooling.

Policy workbench

Policies without middleware sprawl.

Set up common API behavior once and version it with the API. For logic that is truly yours, write a small JavaScript or Python callout.

create-orderAPI route

kind: APIRoute
name: create-order
match:
  method: POST
  path: /orders
flows:
  request:
    - policy: verify-customer
    - policy: orders-quota
    - callout:
        name: enrich-order
        lang: js
        file: resources/js/enrich.js
backend:
  target: orders-service
  path: /orders

What the bundle owns

Identity: OAuth2, JWT, API keys, HMAC, mTLS
Traffic: Quota, spike arrest, cache, retry, timeout
Protection: Validation, threat controls, IP restrictions
Custom logic: Versioned JavaScript and Python scripts

Browse the policy catalog

Own the platform

Give your API teams a better default.

Run Centiceps locally and publish your first managed API.

Read the quickstart See the platform