Express / FastifyThin Node SDKRuntime decisionAllow / Deny
Policy + plan + quotaUsage recorded
Node-first · Express + Fastify
Protect and productize your existing Node API.
Add API keys, policies, plans, quotas, usage tracking, and subscription-gated access to Express and Fastify APIs without adopting a full gateway.
One access path
Clear responsibilities from setup to every request.
Ceiba keeps configuration, integration, and enforcement separate so your application stays in control of its own routes.
Configure
Control Plane
Create projects, issue downstream API keys, define access policies, review plans, and inspect usage.
Integrate
Node SDK
Add thin Express middleware or a Fastify pre-handler to the routes your existing API already serves.
Enforce
Runtime
Evaluate keys, policies, subscription state, quotas, and rate limits before returning an allow or deny decision.
Shipped MVP surface
The recurring access work, in one focused layer.
Protect existing routes without moving your API behind a new gateway or rebuilding access rules inside each handler.
Downstream API keys
Create, expire, revoke, and archive credentials that represent callers of your API.
Route policies
Control access with ordered method and path rules configured for each project.
Plans and limits
Apply plan-level monthly quotas and per-minute rate limits during authorization.
Usage visibility
Review monthly request totals, allowed and denied decisions, and recent activity.
Subscription-gated access
Use synchronized subscription state when Runtime determines whether a request may proceed.
Existing Node routes
Protect Express and Fastify APIs without moving traffic through a Ceiba gateway.
Getting started
From project to protected route.
Use the Control Plane for setup, then add the thin SDK to the Express or Fastify API you already run.
- 1
Create a project
Open the Control Plane and create the project that will own keys, policies, plan state, and usage.
- 2
Configure server credentials
Set CEIBA_RUNTIME_URL, CEIBA_PROJECT_ID, and CEIBA_PROJECT_SECRET on your API server.
- 3
Install the Node SDK
Add @ceibalabs/ceiba-sdk to your existing Node application.
- 4
Protect a route
Use the shipped Express middleware or Fastify pre-handler on the routes that need access enforcement.
- 5
Issue keys and define policies
Create downstream API keys, add method and path policies, then exercise the protected route.
Server-side configuration
CEIBA_RUNTIME_URL=https://runtime.example
CEIBA_PROJECT_ID=your-project-id
CEIBA_PROJECT_SECRET=your-project-secret
npm install @ceibalabs/ceiba-sdkProject secrets stay on your backend. Downstream callers use the API keys you create for them.
Plans and limits
A catalog that grows with request volume.
Every plan supplies the monthly quota and per-minute rate limit Runtime uses during access decisions.
Free
For evaluation, local development, and small prototypes.
- Monthly quota
- 10,000 requests
- Rate limit
- 60 requests / minute
Starter
For early production APIs and small teams that need predictable API access control.
- Monthly quota
- 250,000 requests
- Rate limit
- 600 requests / minute
Pro
For higher-volume production APIs that need more quota and request headroom.
- Monthly quota
- 2,000,000 requests
- Rate limit
- 3,000 requests / minute
Eligible projects can start an initial Starter or Pro subscription through hosted Checkout. Existing paid subscriptions cannot be changed from Ceiba today.
Built for teams whose Node API is becoming a product surface.
A practical fit for API product teams.
API-first SaaS teams
For teams exposing an API as part of the product and starting to need keys, limits, plans, and usage visibility.
AI / data API builders
For teams offering paid or usage-aware access to search, enrichment, retrieval, automation, data, or AI-powered endpoints.
Partner API teams
For B2B SaaS teams exposing selected endpoints to customers, partners, or integrators.
Protect your first route with Ceiba.
Create a project, follow the quickstart, and use the runnable Express or Fastify examples to verify the complete access path.