Halyard puts keys, rate limits, usage and logs behind one gateway. Ship an endpoint in minutes and see every request it serves.
Free up to 1M requests a month
Overview
Gateways, key stores, rate limiters and log pipelines usually live in different places. Halyard runs them as one system with one source of truth.
Keys that know their scope. Issue, rotate and revoke keys per environment, each with only the access it needs.
Limits at the edge. Quotas are enforced before traffic reaches your origin, so a burst never becomes an outage.
One gateway, every region. Requests are routed to the nearest healthy origin and rerouted the moment one fails.
Usage you can bill on. Per-key request counts, bucketed by the hour and ready for invoicing.
Teams shipping on Halyard
Free tier, no card. Your first protected endpoint goes live in minutes.
Requests a month on the free tier, with keys, limits and logs included from the first call.
One key per agent, a spend cap on every key, and a 429 instead of a surprise invoice.
Keys per project. Each one carries its own scopes, rate limit and spend cap.
SSO, signed audit logs and request data that stays in the region you pick.
Pin a project to a region and its request data, logs and usage never leave it.
Halyard sits in front of your origin, so routing, limits and credentials go out as config: staged, observable and easy to reverse.
Point Halyard at a repo and an OpenAPI file. Every push builds a versioned route with its keys and limits already attached.
Deploy orders-api
Triggered by a push to main · 3 files changed
Run a new limit in shadow mode and see exactly what it would have blocked. Enforce it for 5%, 25% or all traffic when the numbers look right.
Roll out a new limit
1,200 req/min per key · sliding window · edge
Issue a new key and keep the old one valid for a window you choose. Halyard revokes it once its traffic has moved over.
Rotate production key Rotating
Overlap window 24h · revoke when old-key traffic reaches zero
Declare the route, its scopes and its limit next to the handler. Halyard enforces them at the edge before your code runs.
1import { Halyard } from "@halyard/sdk";
2
3const halyard = new Halyard({ token: process.env.HALYARD_TOKEN });
4
5export default halyard.route("/v1/charges", {
6 auth: { scopes: ["charges:write"] },
7 limit: { requests: 100, per: "1m", by: "key" },
8 usage: { meter: "charges" },
9 handler: async (req) => createCharge(await req.json()),
10});
POST/v1/charges
Gateway
Keys that know their scope. Issue, rotate and revoke per environment without touching a deploy.
Limits at the edge. Rate limits and quotas enforced before traffic reaches your origin.
Usage you can bill on. Per-key counts turn into invoice lines, exported straight to your billing.
Logs that explain themselves. Every decision traced back to the key, limit and rule that made it.
Integrations
Send logs, usage and alerts to the tools your team already watches. Each connector is a toggle in the dashboard or one line of config.
Not on the wall? Webhooks and a REST API cover the rest.
Browse integrationsObserve
Volume, latency and status codes for every key and route in one view. Hover any minute to see what the gateway served.
Security
Halyard sits in front of your traffic, so we hold it to the bar your auditors will. These are the targets the platform is designed and run to.
SOC 2 Type II
Audit-ready controls. Access, change and incident controls built to the SOC 2 Type II criteria for security, availability and confidentiality.
AES-256
Encrypted end to end. AES-256 at rest and TLS 1.3 in transit. API keys are stored as salted hashes, never in plain text.
US · EU · APAC
Data stays in region. Pin a workspace to one region. Its logs, usage and key material are processed and stored there and nowhere else.
99.99%
Uptime target. Every edge runs in more than one zone, and traffic fails over to the next healthy region without a config change.
These are targets, not a live status feed. We send current audit status and subprocessors on request.
Request the security packWe had keys in one service, limits in another and logs in a third. Moving all of it behind Halyard took an afternoon, and on-call finally got quiet.
Pricing
One price per request, the same features on every plan. Drag the slider to see what your traffic would cost.
Your first million requests each month cost nothing, with every gateway feature switched on.
Pro is $29 a month with 5M requests included. Past that, each million costs $4, dropping to $2 at volume.
Invite the whole team and issue as many keys as you need. Only traffic shows up on the bill.
Works out to $4.36 per million requests.
Free for your first million requests each month. After that you pay per million, with no gateway to run yourself. See pricing