Validate JWTs against any provider, gate routes with API keys, and add a WAF-style network policy — IP rules, geo-blocking and rate limits — declaratively, on any endpoint.
JWT verification against any provider
Verify RS256/ES256/HS256 tokens against JWKS from Auth0, Clerk, AWS Cognito, Firebase or Okta — key rotation handled for you — or against static keys. One assertion, no auth microservice to build.
JWKS with automatic key rotation
API-key auth for multi-tenant access
HMAC signature checks for Stripe / GitHub webhooks
A network firewall on any route
Declare a network policy that runs before any action: IP allow/deny (CIDR + IPv6), proxy-aware client-IP resolution, per-IP rate limiting and GeoIP/ASN blocking — in enforce or monitor mode.
Governed, not bolted on
Because access control lives in the same config as the endpoint, it's versioned, reviewable and deployed together — not scattered across a gateway, a sidecar and a separate auth service.
Frequently asked questions
Which identity providers can Air Pipe validate tokens from? Any provider that publishes JWKS — Auth0, Clerk, AWS Cognito, Firebase and Okta among them — using RS256, ES256 or HS256, with key rotation handled for you. Static keys work too.
Do I need a separate auth service or gateway? No. Token validation, API keys and network policy are assertions in the same config as the endpoint, so they're versioned and deployed with it rather than scattered across a gateway and a sidecar.
Can I rate-limit or geo-block a single route? Yes. A network policy runs before any action on that interface and can do IP allow/deny with CIDR and IPv6, per-IP rate limiting, and GeoIP or ASN blocking — in enforce or monitor mode.
Can I verify Stripe or GitHub webhook signatures? Yes — HMAC signature checks are assertions, so a webhook endpoint can reject anything that isn't genuinely from the sender.