Skip to main content
Zuplo is a developer-first API management platform that helps teams build, deploy, and scale APIs globally. Zuplo uses OpenFGA to enforce fine-grained authorization at the edge across every region the platform runs in.

​
At a glance

​
Why OpenFGA

As Zuplo’s customer base shifted toward larger enterprises, simple project-membership rules were no longer enough. The team evaluated:
  • Axiomatics (AuthZEN-based)
  • Aserto (AuthZEN-based)
  • Auth0 FGA
  • Building a custom solution in-house
They chose OpenFGA because it is open source and self-hostable, and because PostgreSQL as a backend let Zuplo replicate authorization data globally and run checks at the edge — exactly the topology API management requires.

​
Architecture

  • One authorization model governs the entire product, single-tenant.
  • The same model handles user access and API key access to product features.
  • OpenFGA is deployed in production across multiple data centers worldwide.
  • Performance work for major upgrades uses k6-based end-to-end load tests.

​
Outcomes

  • Updating and versioning the authorization model independently of the application code accelerated development cycles.
  • Roles and permissions can be tested and refined without code changes.
  • Authorization is centralized across teams while keeping concerns separate.
  • Caching introduced upstream replaced a homegrown cache layer Zuplo had built before OpenFGA shipped its own.

​
Outlook

Zuplo continues to file feature requests upstream and has expressed interest in publicly sharing more details about how it implements authorization at the edge.

​
Source

This case study is based on the public CNCF TOC adopter interview with Nate Totten, Co-founder & CTO of Zuplo, available in the cncf/toc repository.
Last modified on September 28, 2026