Protect an HTTP API in 5 Minutes
Add authentication, rate limiting, and cost tracking to any REST or GraphQL API.
SatGate Cloud
Already on cloud.satgate.io? Use the Quick Setup Wizard to protect any API in 5 minutes.
Create a Route
Point SatGate at your upstream API
Mint a Token
Generate capability tokens for your users
Share URL + Token
Hand out the proxy URL and token
This opens the authenticated cloud dashboard and preserves your destination through login.
Every plan. Only owners and admins can set up the route and create the tokens.
Calling a paid (L402) route
Send X-SatGate-Tenant with your tenant slug. A 402 includes the invoice, a challenge macaroon, terms.status, and status_url. Retry with Authorization: L402 <macaroon>:<preimage>.
The owner can pay from any wallet. If that wallet hides the preimage, poll GET status_url with Authorization: L402 <macaroon> (macaroon only) at least every 10 seconds until status is paid, then retry with the returned authorization value. A 401 tells you to send that header. Pickup is not access. X-SatGate-Spend-Mode: paid_rail means the 402 is a Lightning quote, not an empty budget.
Paying with USDC (x402)
If the route owner turned on USDC, the same 402 also offers x402: a PAYMENT-REQUIRED header (base64 JSON) and an accepts list in the body with the network, the USDC contract, the amount in atomic units (6 decimals, so 10000 is $0.01) and the payTo address. Sign that exact amount with any x402 v2 client and retry with a PAYMENT-SIGNATURE header.
SatGate settles the payment, confirms the transfer on Base, then serves the request once. The response carries PAYMENT-RESPONSE with the transaction hash, and the signed receipt records the payment. Sending the same signature again gets a new 402. Route owners turn this on per route in the Cloud route editor under Also accept USDC (x402).