FAQ
Practical answers about the shipped Node-first MVP, its access model, and the current subscription path.
- What is Ceiba?
- Ceiba is a Node-first layer for protecting and productizing existing APIs. It helps teams add API keys, policies, plans, quotas, usage tracking, and subscription-gated access without adopting a full gateway or rebuilding the whole access stack inside their application.
- Who is Ceiba for?
- Ceiba is for developers and teams that already have an API and are starting to need controlled customer, partner, or product access. The strongest MVP fit is an existing Node.js service using Express or Fastify.
- What problem does Ceiba solve?
- When an API becomes part of a product, teams need to decide who can call it, which routes they can reach, what plan they are on, how much they can consume, and when access should stop. Ceiba keeps that recurring access work out of individual route handlers.
- Is Ceiba a full API gateway?
- No. Ceiba is intentionally not a full gateway. It provides a focused access and productization layer for keys, policies, limits, usage, and subscription-linked access. Traffic continues to enter the API you already operate.
- Does Ceiba require a gateway migration?
- No. The Node SDK protects routes in your existing Express or Fastify application and delegates access decisions to Ceiba Runtime.
- Which frameworks are supported?
- The MVP supports Node.js with Express and Fastify. The SDK ships ceibaExpressMiddleware for Express and ceibaFastifyPreHandler for Fastify.
- Is Ceiba only an API key product?
- No. API keys represent downstream callers, while policies, subscription state, monthly quotas, rate limits, and usage all participate in the access model.
- Where are access decisions enforced?
- The Control Plane configures projects, keys, policies, plans, and subscriptions. Your API uses the thin Node SDK to call Runtime, and Runtime returns the request-time allow or deny decision.
- Which credentials does Ceiba use?
- Your backend uses a project ID and project secret when calling Runtime. Downstream callers use the API keys you create for them. Project secrets and raw API keys are shown once and should be stored securely.
- Which plans are available?
- The MVP catalog contains Free ($0), Starter ($25/month), and Pro ($79/month). Each plan defines a monthly request quota and a per-minute rate limit.
- How does paid subscription Checkout work?
- You can start a Starter or Pro subscription through hosted Checkout, either from your account in the Control Plane or directly from a plan on this site. Checkout completion synchronizes your subscription state back to Ceiba automatically.
- Can an existing paid subscription change plans?
- Yes. An account with an active paid subscription can switch between Starter and Pro, or cancel at the end of the current billing period, directly from the Control Plane. Starting a new Checkout session for an account that already has an active subscription is not allowed, to avoid creating a duplicate.
- What usage information is available?
- The Control Plane shows monthly request totals, allowed and denied breakdowns, remaining quota, monthly history, and recent access activity for the selected project.
- Why not build this in-house?
- Some teams can build the first slice themselves. The long-term burden usually appears in key lifecycle, policy changes, quota and rate enforcement, subscription synchronization, usage visibility, stable denial behavior, and operator tooling. Ceiba packages that recurring work into one focused path.
- How do I get started?
- Create a project in the Control Plane, keep the one-time project secret on your backend, configure the three CEIBA server variables, install @ceibalabs/ceiba-sdk, and follow the Quickstart for Express or Fastify.
Protect your first Express or Fastify route
The Quickstart connects Control Plane credentials to the thin Node SDK and Runtime enforcement path.