Four services. One binary.

// SYNOPSIS

// DESCRIPTION

Routes, shapes, versions, and rate-limits traffic in the PoP nearest the caller. Canary by percentage or header; roll back in one command. WASM transforms when you need to bend a request without touching origin code.

• ▸ Weighted canary + one-command rollback
• ▸ Per-key and per-route rate limits
• ▸ Request/response transforms in WASM

// SPECS

Overhead

+1.2 ms p99

Regions

34 PoPs

// SYNOPSIS

// DESCRIPTION

Stale-while-revalidate at the edge, surrogate keys, and tag-based purges that land globally in under 900 ms. Your origin gets to sleep.

• ▸ Global purge in under 900 ms
• ▸ Surrogate keys + tag invalidation
• ▸ SWR, ESI, and range caching

// SPECS

Hit rate

94% median

Purge

<900 ms

// SYNOPSIS

// DESCRIPTION

JWT validation, OAuth2/OIDC flows, and service-to-service mTLS terminated in the PoP. Invalid tokens never reach your network.

• ▸ JWT/JWKS validation at the PoP
• ▸ OAuth2 + OIDC with any provider
• ▸ mTLS for service-to-service calls

// SPECS

Origin round-trips

0

Token cache

per-PoP

// SYNOPSIS

// DESCRIPTION

Per-route latency histograms, distributed traces, and OpenTelemetry export. Alerts fire on SLO burn rate, so a slow Tuesday does not page you.

• ▸ Route-level histograms, live
• ▸ OpenTelemetry + Prometheus export
• ▸ Burn-rate alerts to Slack / PagerDuty

// SPECS

Event → graph

10 s

Retention

13 mo