The token is checked here
01 / 06
A JWT is validated against Hanzo IAM's JWKS before anything else reads the request. Opaque API keys aren't JWTs, so they go on to the service that issued them and it decides.
HanzoGateway
The trust boundary in front of the API
Nothing downstream has to ask who is calling
Gateway answers that once, at the edge, so every service behind it can read an org id and believe it.
Identity headers are written, not trusted
02 / 06
X-User-Id, X-Org-Id, X-Roles and every X-IAM-* variant are stripped from every inbound request, then written back from the verified claims — sub, owner, roles. A curl flag can't set them.
No route map, deliberately
03 / 06
For api.hanzo.ai it forwards /* straight to Hanzo Cloud, which owns the /v1 mount table. A second table here would be a second thing to keep in sync, and the first one to go stale.
Rate limits per caller and overall
04 / 06
Token-bucket limits by client IP and across the edge as a whole, with per-endpoint overrides in config. A rejected request gets a 429 and a Retry-After, not a dropped connection.
Liveness that consults nothing
05 / 06
The health check answers whether the process is up and asks no backend. A probe that fails when a dependency blinks restarts a healthy process and turns one outage into two — so backends are dialed lazily and degrade per request instead.
A hop, or no hop at all
06 / 06
Run it as its own service in front of the API, or mount it inside the cloud binary with one call. Same checks either way — one less network hop when you don't want one.
client
- JWT
every service behind it
- X-User-Id stripped
- X-Org-Id stripped
- X-User-Id ← sub
- X-Org-Id ← owner
- X-Roles ← roles
Paste and ship
Paste this into any agent. It reads the skill manifest and calls Gateway from there.
api/v1/gateway
Read https://hanzo.ai/skill.md and use Hanzo Gateway in my project. Start with: hanzo gateway config get
Example project. Every name in it is one you would give your own.
- gatewayReady
- payments-apiReady
- checkout-webBuilding
- docs-siteReady
Every request enters here, so the limiter does too.
A build is running from the last commit on main.
Static, published by the same pipeline as the rest.
api.hanzo.ai/v1/gatewayOpen in the console ↗
The service the session above is changing.
