Origin shield for APIs

An origin shield for your API.

Give clients your EchoRelay URL. We authenticate, validate, rate-limit, and check caller IP allowlists before delivery. Your service controls who can reach it directly.

Worked example

Validate an employee lookup before it reaches your directory

Your app looks up employees through an EchoRelay endpoint. Configure its validation rules to require employeeId as a string before forwarding the request. This example uses a fictional directory API.

Passes the configured payload validation

{
  "employeeId": "EMP-42"
}

Rejected with HTTP 422: employeeId is a number

{
  "employeeId": 42
}
  1. Add your directory service as a synchronous target and configure its authentication.
  2. Require a caller API key, set the payload validation rules, and choose your rate limits and caller IP allowlist.
  3. Publish and give your app the EchoRelay URL. Restrict direct access to your directory service in your own network configuration.

Your directory must be reachable by EchoRelay at a public network address. Protecting it from direct callers requires access controls on your service as well. EchoRelay rejects requests that fail your configured checks before calling the target.

Why EchoRelay

Less to build, less to run.

One URL for your callers

Callers use your EchoRelay endpoint. Your service must be reachable by EchoRelay at a public network address; configure access controls there to restrict direct callers.

Screened at the edge

Requests are authenticated and validated against your schema, with rate limits and allowlists in front. Malformed or abusive traffic stops here.

Flood protection at the edge

Your rate limit and IP allowlist are enforced at the edge, so excess traffic and unknown callers stop with us.

Questions

Answered, honestly.

What is an origin shield for an API?
It is a layer in front of your API that authenticates, validates, and rate-limits requests before delivery. Your service must be reachable by EchoRelay at a public network address. Restricting direct access also requires access controls on your service.
Which requests does an origin shield turn away?
Anything over your rate limit and any burst headroom, callers outside your IP allowlist, and payloads that fail your schema. Each gets an error at the edge, and the rest is delivered.
Do you verify webhook signatures for me?
Yes, for GitHub, Stripe, any Standard Webhooks sender that signs with a shared secret, and any sender that signs with an HMAC: an endpoint can accept only requests the sender signed, with no API key in the sender’s URL. Other callers authenticate with an API key you mint, and payloads are validated against your schema either way.

Connect everything. Deploy nothing.

Start free See origin shield

No credit card required.