Unwanted API calls stop before your server

AegisX counts requests per API key, checks tokens and compares each request with your API description. Requests that do not belong are stopped on our side.

Protect your site for free See pricing

GET /api/v1/ordersAllowed
POST /api/v1/orders ×900Stopped: key limit
GET /api/v1/admin/usersStopped: no token
DELETE /api/v1/payments/7Stopped: not in the API spec
GET /api/v1/items?limit=abcStopped: wrong parameter

How it works

Limits per key, not per address

Requests are counted by API key: from a header, cookie, query parameter or token. Clients behind one NAT do not share a limit, and a key used from a hundred addresses is still limited.

Guessing keys does not help

An address that tries many keys counts as one client. Requests without a key have a limit of their own.

Tokens checked before your server

Chosen paths need a valid JWT. We check the signature, expiry, issuer and audience. Both a shared secret and public keys from a JWKS URL work.

Your API spec as the allow list

Upload an OpenAPI 3 or Swagger 2 file in JSON. Requests with an unknown method or path, or a parameter of the wrong type, are blocked or only logged, as you choose.

A spec from real traffic

No spec yet? The dashboard drafts one from the requests your API already gets.

The rest of the protection still applies

The WAF, bot protection and site limits cover the API too. Your integrations can skip the browser check.

See who uses your API and how

The API endpoints that are actually called.
The reason for every block: key limit, token or spec.
Log-only mode to try the settings before blocking.

Overview All sites protectedExample

Requests, 24 h

1.84M

+6.2%

Blocked

412K

22.4%

From cache

61%

of static files

Traffic and blocked requests

Common questions

Setup, DNS, SSL and account questions are answered in Help.

Will our mobile app keep working?

Yes. Turn off the browser check for your API paths, and apps and integrations pass without it. Limits and tokens are checked without the user noticing.

What does a client get over the limit?

A 429 response with Retry-After: how many seconds to wait before trying again.

Do we need to change our API?

No. Keys and tokens stay yours, AegisX only checks them. The secret for token checks is stored encrypted and is not shown again in the dashboard.

Which plans include it?

All plans.

Your first site is free

Create account Compare plans