Credential-scoped API gateway

What it is

Automation touches dozens of SaaS APIs. Every one of them wants a credential. SubOracle sits in the middle: the automation talks to it, it talks to the API and the credential never leaves the proxy. Scoped credentials, route allowlists and read-only rules get enforced in one place instead of being re-implemented in every script.

It speaks the auth schemes APIs actually use: API keys, bearer tokens, basic, OAuth2, HMAC and AWS SigV4. It ships with an admin UI, OpenAPI import and an audit store so every request through it is a record.

Under the hood

• Scoped credentials: each endpoint gets its own credential with placement rules. A leaked automation script leaks nothing upstream.
• Route allowlists and read-only rules: an endpoint can be read-only, or limited to specific paths, enforced at the proxy.
• Six auth schemes: apikey, bearer, basic, OAuth2, HMAC and AWS SigV4, plus request rewriting and secret injection into bodies.
• Encrypted credential storage under a master key, with an admin API, CLI and browser UI.
• OpenAPI import: point it at a spec and the routes populate themselves.
• An audit store: every request through the proxy is queryable after the fact.

Why Go

A credential-injecting proxy sits in the hot path of every request. It has to be small, fast and boring. Go made the concurrency easy and the binary self-contained. The design principle was simple: automation should never hold an upstream credential again.

Stack