The GitOps-Driven API Gateway for Any Infrastructure

Traefik Hub API Gateway is an enterprise-grade API gateway built on top of Traefik Proxy, the world's most downloaded cloud-native proxy, with 3.5 billion downloads and counting. It adds centralized access control, distributed security, AI Gateway, MCP Gateway, native WAF, and premium integrations, all in a fully declarative, GitOps-driven platform. It is the only API gateway that is both fully declarative and cloud-native from inception.

Traefik Proxy handles routing, load balancing, and TLS for microservices. Traefik Hub API Gateway builds on that foundation with enterprise capabilities: OIDC/LDAP/JWT/HMAC/OAuth2 access control, native WAF, distributed rate limiting, FIPS validated cryptography, AI Gateway, MCP Gateway, multi-cluster management, and full GitOps compliance. The upgrade takes seconds. There's no reconfiguration, no learning curve, and all existing configurations remain intact. See the full feature comparison on this product page.

Yes. Traefik supports over 90% of ingress-nginx annotations used in production and includes a native ModSecurity WAF built in. Teams migrate without configuration changes and get SQLi, XSS, and OWASP Top 10 threat protection from day one. No separate WAF tool required.

Yes. Traefik works across Nutanix AHV, SUSE Virtualization, and other modern hypervisors, providing Layer 7 routing, security, and policy enforcement without assembling separate tools. Teams migrating away from VMware can standardize on a single control plane across VMs, containers, and AI workloads.

Traefik Hub API Gateway supports OIDC, LDAP, JWT, HMAC, and OAuth2 for authentication and authorization, all configurable as declarative middleware across all API traffic without additional identity infrastructure. For regulated industries, it also supports WAF, distributed rate limiting, and distributed TLS with FIPS validated cryptography, making it suitable for FedRAMP, PCI DSS, and GDPR environments.

Yes. It is the only API gateway that is fully declarative end-to-end. Every route, policy, and middleware is defined in code, stored in Git, and automatically applied through ArgoCD, FluxCD, or any CI/CD pipeline. No UI configuration is required. Changes are auditable, reversible, and consistent across environments.

Yes. Traefik natively integrates with AKS, EC2, ECS, RKE2, K3s, NKP, and other distributions, enabling organizations to apply the same configurations across orchestrators without separate per-environment policies. It runs identically across Kubernetes, Nomad, Docker, VMs, public clouds, private clouds, and on-premises, with centralized control and data planes and automatic configuration syncing.

Traefik Hub API Gateway is stateless and horizontally scalable by design. It supports active health checks, circuit breaker protection, distributed rate limiting, traffic mirroring, and blue-green/canary deployments, which are all configurable as code for zero-downtime operations.

Traefik Hub API Gateway supports Go and WebAssembly (WASM) plugins—no Lua required. Teams can use plugins from the community catalog or build custom plugins to extend gateway behavior without modifying the core binary.