Your spec is your gateway
Stop maintaining two sources of truth. Barbacane uses your OpenAPI and AsyncAPI specifications as the single source of truth for routing, validation, authentication, and event bridging.
The problem with traditional API gateways
Two sources of truth
Your OpenAPI spec defines your API, but your gateway has its own configuration. They inevitably diverge, causing bugs and security issues.
Wasted time reconciling
Teams spend hours syncing gateway config with API specs, debugging mismatches, and fixing inconsistencies that shouldn't exist.
The Barbacane approach
One spec. Zero configuration drift. Automatic enforcement.
Write your API spec
Use OpenAPI or AsyncAPI with x-barbacane-* extensions
for auth, rate limiting, and routing.
Compile to an artifact
Run barbacane compile to generate an optimized
binary artifact. Validation happens at compile time.
Deploy and run
Deploy the artifact to your gateway. Routing, validation, auth — everything works exactly as specified.
Everything you need in an API gateway
Built in Rust for speed and safety. Extended with WebAssembly for flexibility.
Request Validation
Automatic JSON Schema validation for bodies, parameters, and headers. Invalid requests never reach your backend.
Authentication
Built-in JWT, API Key, and OAuth2 authentication. Configured directly in your OpenAPI security schemes.
Blazing Fast
Sub-microsecond routing and validation. Built on Rust, Tokio, and Hyper for maximum performance.
WASM Plugins
Extend functionality with WebAssembly plugins. Sandboxed execution means plugins can't crash your gateway.
Observability
Prometheus metrics, OpenTelemetry traces, and structured logging. Full visibility into your API traffic.
AsyncAPI & Event Bridging
Bridge HTTP to event-driven systems. Route requests to Kafka, NATS, or AWS Lambda using AsyncAPI specs.
Control & Data Plane Split
Autonomous data planes that run independently. Zero-downtime deployments with hot-reload updates pushed from the control plane.
Web UI
Visual control plane for managing projects, specs, plugins, and deployments. No YAML wrestling required.
Edge Ready
Data planes are lightweight compiled artifacts. Deploy anywhere — cloud, on-prem, edge locations, or embedded devices.
Enterprise-grade architecture
Separate control plane and data plane for maximum resilience and flexibility.
Control Plane
The management layer for your API gateway fleet. Handles configuration, compilation, and deployment orchestration.
- Web UI for visual management
- Plugin registry with schema validation
- Spec compilation and artifact builds
- Push deployments to data planes
Data Plane(s)
The runtime layer that handles actual API traffic. Fully autonomous — keeps running even if the control plane is down.
- Hot-reload without restarts
- Zero-downtime deployments
- TLS termination and mTLS support
- Resilient to control plane outages
Built for teams who take APIs seriously
Platform Teams
Building an internal developer platform? Barbacane enforces consistent API standards and policies automatically.
- Self-service API publishing
- Automatic policy enforcement
- Centralized observability
API Product Companies
Exposing public APIs? Barbacane ensures your contracts are strictly enforced and your documentation is always accurate.
- Contract-first development
- Always-accurate documentation
- Version and lifecycle management
Enterprises Modernizing
Migrating from legacy gateways? Barbacane's spec-first approach brings order to complex API landscapes.
- Gradual migration path
- Compliance-ready logging
- Hybrid cloud support
No enterprise edition. No feature gating.
Barbacane is fully open source under the Apache 2.0 license. Every feature is available to everyone. We make money through consulting, support, and training — not by holding features hostage.
Star on GitHubReady to simplify your API gateway?
Get started in minutes. Write your spec, compile, and deploy.
# Install Barbacane
cargo install barbacane
# Compile your spec
barbacane compile api.yaml -o api.bca
# Run the gateway
barbacane run api.bca