Uploaded July 2026 | Updated September 2026, 4 hours ago

---

WorkOS launches its API Gateway in early access. Instead of calling out to WorkOS to validate each API key, the gateway verifies it inline and exchanges it for a JWT carrying user ID, org ID, and permissions — no outbound call, no separate validation logic. Cameron demos securing an app in ~10 lines. Roadmap: per-key rate limiting, OpenAPI-driven permission enforcement, and agent-ready traffic control, all enforced at the edge.

Topics: API Gateway, API key auth, JWT, edge validation, rate limiting, agentic APIs.

Link: workos.com/blog/api-gateway
Chapters:

00:00 – WorkOS API Gateway
00:25 – What is the API Gateway?
01:00 – Why pair a gateway with your auth provider
01:41 – Live demo: Pokemon API setup
02:14 – Adding the auth middleware
03:01 – Calling direct vs. through the gateway
03:38 – Testing with real vs. fake API keys
04:03 – Edge validation: why it's faster