Security you can build on
Security is a first-class part of RoutexAPI, not an afterthought. Here is how we protect credentials and data.
Upstream secrets are never exposed
A publisher's upstream credential is envelope-encrypted at rest and decrypted only in gateway request memory. It is never logged, returned, cached, or shown — only the gateway can use it to reach the upstream.
Consumer keys are hashed
The API keys buyers use to call the gateway are hashed with Argon2id at rest and shown in full only once at creation. Keys can be rotated with a grace period.
Accounts and sessions
Account passwords are hashed with Argon2id, optional TOTP two-factor is supported, and sessions use short-lived access tokens with rotating refresh tokens and reuse detection.
Least privilege and isolation
Authorization is enforced on the server for every action with deny-by-default ownership checks, so one user can never reach another user's APIs, subscriptions, or keys.