Multi-tenant API gateway

Expose your APIs. Without exposing everything.

Wrap NetSuite, Salesforce, or any internal API with a proxy that your customers can call safely. Issue signed API keys, filter responses to only the fields you want shared, and audit every request.

customer.sh
curl https://api.proxyflow.app/p/acme/customers/123 \
  -H "Authorization: ApiKey pf_xxx:<hmac>" \
  -H "X-Timestamp: 1739000000" \
  -H "X-Nonce: 7b9a..."

{
  "id": "123",
  "name": "Acme Corp",
  "email": "billing@acme.com"
}
// Internal fields (SSN, balance, notes) filtered out

Built for teams that hand out APIs

Everything you need to safely give your customers programmatic access — without rebuilding a backend for each integration.

Multi-tenant by design

Each organization owns its upstreams, routes, and consumers. Members manage them; end-customers call them.

HMAC-signed requests

API keys plus per-request HMAC signatures with timestamp + nonce. No replay, no token theft.

Field-level response shaping

Pick the fields that flow through with an allowlist, or write a JSONata expression for full transforms.

Five upstream auth methods

API key headers, Basic, Bearer, OAuth2 client credentials with token caching, or custom headers.

Every call is logged

Method, latency, upstream status, error code. Searchable per route and per consumer.

Edge runtime

Proxy requests execute on the same edge as your dashboard. Sub-100ms overhead.

Stop building one-off API wrappers

Spin up your first proxy in under five minutes.