Weik.io

API Management Overview

Manage and secure APIs with Weik.io APIM

Weik.io API Management uses a YARP-based reverse proxy to handle traffic. You set up your APIs using three resources: Api (the base path), ApiVersion (the routing rules), and ApiSubscription (the access controls).

Configuration resources

Api

The Api resource defines the base URL prefix, the entry point for a specific service.

apiVersion: weik.io/v1alpha1
kind: Api
metadata:
  name: webhook
  description: The Webhook.site TEST API
spec:
  prefix: hook

In this example, the prefix maps to https://your-host/hook/....

ApiVersion

The ApiVersion tells the proxy where to send the traffic. It uses standard YARP routing syntax.

apiVersion: weik.io/v1alpha1
kind: ApiVersion
metadata:
  name: v1
  description: Webhook.site test using direct forwarding
  category: proxy
spec:
  apiName: webhook
  isActive: true
  connection:
    automaticDecompression: GZip
  parameters:
    routes:
      route:
        clusterId: "cluster"
        match:
          path: "{**catch-all}"
    clusters:
      cluster:
        destinations:
          cluster/destination1:
            Address: "https://webhook.site/99f574f3-a9c3-4723-aae3-ecb98cc4e395"

The parameters section defines the routes and destination clusters, supporting scenarios from direct forwarding to load balancing.

ApiSubscription

An ApiSubscription determines which callers can access the API. If you do not define one, the API is inaccessible by default.

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: my-apikey
  description: Subscription using X-API-Key header
  category: apikey
spec:
  apis:
    - webhook
  isActive: true
  parameters:
    key: "NGWdkceFPYyXmaH15jS3K0uCsk7KnnPA"

Authentication methods

Weik.io supports several authentication methods, controlled through the ApiSubscription category.

API key

The simplest method. Clients pass the key via a header.

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: my-apikey
  category: apikey
spec:
  apis:
    - webhook
  isActive: true
  parameters:
    key: "your-api-key"

Basic authentication

Username and password over HTTPS.

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: dev-basicauth
  category: basic
spec:
  apis:
    - webhook
  isActive: true
  parameters:
    username: "hello"
    password: "test123"

OpenID Connect (OIDC)

You can validate tokens from an OIDC provider such as Azure AD or Keycloak.

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: oidc-aad
  category: oidc
spec:
  apis:
    - webhook
  isActive: true
  parameters:
    issuer: "https://sts.windows.net/your-tenant-id/"
    audience: "api://your-api-id"

Anonymous

To make an endpoint publicly accessible, you still need an ApiSubscription that explicitly allows anonymous access.

apiVersion: weik.io/v1alpha1
kind: ApiSubscription
metadata:
  name: anonymous-apis
  category: anonymous
spec:
  apis:
    - webhook
  isActive: true

Next steps