--- title: API gateway gallery: Drop-in API policy management examples description: A collection of drop-in YAML policy templates for configuring ngrok's API gateway using its Traffic Policy engine. Covers JWT authentication, tiered rate... canonical: https://daily.dev/posts/api-gateway-gallery-drop-in-api-policy-management-examples-kg3tshpxz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: API gateway gallery: Drop-in API policy management examples | daily.dev og:description: A collection of drop-in YAML policy templates for configuring ngrok's API gateway using its Traffic Policy engine. Covers JWT authentication, tiered rate... og:url: https://daily.dev/posts/api-gateway-gallery-drop-in-api-policy-management-examples-kg3tshpxz og:image: https://api.daily.dev/og/posts/kG3tsHPxz.png og:image:alt: API gateway gallery: Drop-in API policy management examples og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # API gateway gallery: Drop-in API policy management examples **[ngrok Blog](https://daily.dev/sources/ngrok)** · 10 min read · 0 upvotes · 0 comments ## Summary A collection of drop-in YAML policy templates for configuring ngrok's API gateway using its Traffic Policy engine. Covers JWT authentication, tiered rate limiting, geo-blocking, API version deprecation, header manipulation, response compression, TLS enforcement, observability logging, and request size limits, deployable via cloud endpoints or the ngrok agent. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I add JWT authentication and rate limiting to an API using ngrok's gateway? Use ngrok's Traffic Policy engine with a YAML policy that validates JSON Web Tokens issued by an identity provider like Auth0 and applies rate limits to incoming requests. This combination rejects unauthenticated machine-to-machine requests and caps usage to prevent accidental denial-of-service and control costs, and can be attached to either a cloud endpoint or an agent endpoint via a policy.yaml file. _See how daily.dev surfaces API gateway configuration patterns for developers building secure APIs._ ### How can I apply different rate limits to authenticated versus unauthenticated API consumers? Configure two tiers of rate limiting in a traffic policy, for example 10 requests per minute for unauthorized users and 100 requests per minute for users presenting a valid JWT with an Authorization header. This lets public APIs offer limited trial access while rewarding signed-up consumers with higher limits, all defined declaratively without touching upstream application code. _Developers comparing rate-limiting strategies can track approaches like this one via daily.dev._ ### How do I deprecate old versions of an API while keeping requests working for consumers on the current version? Require an X-Api-Version header on incoming requests and configure the gateway to deny requests that don't match the currently supported version, returning a custom JSON response explaining the rejection. This lets teams increment supported API versions and cut off outdated ones without modifying the upstream service itself. _Teams planning API version deprecations can follow patterns like this through daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#devtools](https://daily.dev/tags/devtools), [#authentication](https://daily.dev/tags/authentication), [#api-gateway](https://daily.dev/tags/api-gateway) [View this post on daily.dev](https://daily.dev/posts/api-gateway-gallery-drop-in-api-policy-management-examples-kg3tshpxz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"API gateway gallery: Drop-in API policy management examples","url":"https://daily.dev/posts/api-gateway-gallery-drop-in-api-policy-management-examples-kg3tshpxz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/api-gateway-gallery-drop-in-api-policy-management-examples-kg3tshpxz"},"datePublished":"2026-08-23T07:21:37.058Z","dateModified":"2026-08-23T07:29:33.203Z","description":"A collection of drop-in YAML policy templates for configuring ngrok's API gateway using its Traffic Policy engine. Covers JWT authentication, tiered rate...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9edb8d681b86bdfc5f1e1872c5eff738?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9edb8d681b86bdfc5f1e1872c5eff738?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/api-gateway-gallery-drop-in-api-policy-management-examples-kg3tshpxz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,devtools,authentication,api-gateway","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"API gateway gallery: Drop-in API policy management examples"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/api-gateway-gallery-drop-in-api-policy-management-examples-kg3tshpxz#faq","mainEntity":[{"@type":"Question","name":"How do I add JWT authentication and rate limiting to an API using ngrok's gateway?","acceptedAnswer":{"@type":"Answer","text":"Use ngrok's Traffic Policy engine with a YAML policy that validates JSON Web Tokens issued by an identity provider like Auth0 and applies rate limits to incoming requests. This combination rejects unauthenticated machine-to-machine requests and caps usage to prevent accidental denial-of-service and control costs, and can be attached to either a cloud endpoint or an agent endpoint via a policy.yaml file. See how daily.dev surfaces API gateway configuration patterns for developers building secure APIs."}},{"@type":"Question","name":"How can I apply different rate limits to authenticated versus unauthenticated API consumers?","acceptedAnswer":{"@type":"Answer","text":"Configure two tiers of rate limiting in a traffic policy, for example 10 requests per minute for unauthorized users and 100 requests per minute for users presenting a valid JWT with an Authorization header. This lets public APIs offer limited trial access while rewarding signed-up consumers with higher limits, all defined declaratively without touching upstream application code. Developers comparing rate-limiting strategies can track approaches like this one via daily.dev."}},{"@type":"Question","name":"How do I deprecate old versions of an API while keeping requests working for consumers on the current version?","acceptedAnswer":{"@type":"Answer","text":"Require an X-Api-Version header on incoming requests and configure the gateway to deny requests that don't match the currently supported version, returning a custom JSON response explaining the rejection. This lets teams increment supported API versions and cut off outdated ones without modifying the upstream service itself. Teams planning API version deprecations can follow patterns like this through daily.dev."}}]} ```