Apoxy:// Home

Networking for
Operators and Agents

The programmable, tunneled network layer for everything you run. Connect services, clusters, clouds, and agents.
No plumbing, no glue code, just APIs and a CLI.

Try Apoxy for free → Read the docs

FIG. 01 REV. A

Bandwidth

$0.05 /GB

100 GB free to start

PoP coverage

35 +

Locations close to your users

Requests

$1 / M

HTTP · WebSocket · gRPC

TLS

Unlimited

For any domain. No surcharge.

Ingress + egress · one data plane

Expose your services.
Cage your agents.

One hosted Envoy-based data plane for both directions of your traffic. On ingress it routes and load-balances client traffic to your services; on egress it brokers, authenticates, and caps every call your workloads and agents make. No sidecars.

OPERATORS · GATEWAY API

Route the internet to your services.

Tunneled ingress from any VPC or on-prem — QUIC or Geneve.
Hosted Gateway API for L4 and L7 routing.
Run your own code at the edge.
End-to-end OTLP telemetry.

Explore the platform →

AGENTS · CLRK

Control everything your agents reach.

Run untrusted agents in gVisor sandboxes.
Inject credentials the agent never sees.
Cap LLM spend with token budgets.
Lock down egress and trace every call.

Explore CLRK →

01ConnectTunnels

Tunneled ingress.

Connect your VPC or on-prem directly to the edge over QUIC or a secure Geneve tunnel. One tunnel, both directions — ingress, plus egress when you want it. No holes to punch, no peering to configure, no static IPs to manage.

FIG. 02 REV. C

Clients

api.example.com

zone delegation · CNAMEs

geo-distributed · TLS-secured

DNS · Anycast IP match · forward

Apoxy edge

apoxy.app

35+ PoPs

DDoS · Gateway API · OTLP

QUIC · Geneve bidirectional

Customer VPC / K8S Cluster

api.default.svc.cluster.local

private subnet

HTTP(S) · TCP · UDP

Tunnel modes

Kernel · Userspace

Accelerated with XDP for high performance. gVisor + SOCKS5 for constrained environments.

Protocols

HTTP(S) · TCP · UDP

Full L4 reach over a single tunnel. Not limited to web traffic like most overlays.

Traffic flow

Fully bidirectional

One link carries inbound client traffic and egress from the edge back into your VPC or on-prem network.

02RouteGateway API

Gateway API.
Hosted.

Built on the CNCF Gateway API open standard. A role-oriented config model for L4 and L7 routing. Declare routes as YAML and apply them through the API, CLI, or your existing GitOps pipeline. The same manifests run on your cluster, on the edge, or both.

HTTPRoute

TLSRoute

TCPRoute

GRPCRouteComing soon

UDPRouteComing soon

routes / api.yaml FIG. 03

# Send /v1/* on api.example.com to the api Backend.
apiVersion: gateway.apoxy.dev/v1
kind: HTTPRoute
metadata:
  name: api-route
spec:
  parentRefs:
    - kind: Gateway
      name: default
  hostnames:
    - "api.example.com"
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /v1
      backendRefs:
        - kind: Backend
          name: api-backend
          port: 8080

03ComputeServices

Programmable edge.

Deploy JavaScript, TypeScript, or WebAssembly. Rewrite requests, call your origin, reshape responses. Built on the workerd runtime — open source, standards-based, no lock-in.

Services reference →

services / canary-router.ts FIG. 04

// A/B route based on a cookie, stamp a trace header,
// and rewrite the upstream host before forwarding.
export default {
  async fetch(request, env, ctx) {
    const url = new URL(request.url);
    const bucket = request.headers.get("cookie")?.includes("exp=B")
      ? env.API_B : env.API_A;

    url.hostname = bucket;
    const upstream = new Request(url, request);
    upstream.headers.set("x-trace-id", crypto.randomUUID());

    const response = await fetch(upstream);
    return new Response(response.body, response);
  }
};

04ObserveOTLP

Telemetry,
end to end.

Stream to managed sinks, ship to any OTLP endpoint, or ask your agent in plain English via our MCP server.

Third-party sinks

Stream traces, logs, and metrics to Datadog, Grafana Cloud, or Axiom. Pre-built pipelines — no sidecars, no custom shippers.

Any OTLP endpoint

Bring your own collector. Anything that speaks OTLP/HTTP or OTLP/gRPC is a valid destination. Drop in a custom OTel config when you need it.

MCP server

Connect your AI assistant and ask about your traffic in plain English — latency, error rates, top paths, status codes. It queries your Envoy access logs for you. No dashboards to wire up by hand.

Skip the
glue code.

Connect a domain, paste a worker, route some traffic. No agents. No sidecars. No rewrites.

Get started for free → Browse the docs Talk to a founder

Networking forOperators and Agents

Expose your services.Cage your agents.