API gateway for banks and financial services, in your own infrastructure
Banks open payment, account and card APIs to their own channels and to partners, and every change to them has to be accounted for. G8 runs in your infrastructure, with identity at the gateway, data masking and an audit record of every change.
What banks need from an API gateway
Bank APIs carry sensitive data and serve partners with very different needs. The gateway in front of them has to show who called, who changed what and where the data went.
Partners with their own access
Each partner needs its own credentials, its own limits and nothing beyond its own APIs.
With G8Each partner is a Consumer with its own authentication and limits. Restrict a Route to the Consumers you name.
Sensitive data in logs
Card numbers and tokens end up in log lines and request records.
With G8data-mask removes them from logged lines, and Traffic Explorer masks values before a record is stored.
Changes that must be accounted for
Every change to a production gateway has to be traceable.
With G8Roles per Environment, and an audit record written before each change is applied.
Language models in internal tools
Staff tools start calling language models, often with keys in the code.
With G8Calls to models go through Routes with token limits and prompt rules.
The areas of G8 a bank uses
A typical bank uses API Security at the gateway, API Gateway for traffic and records, and AI Gateway for assistants used by staff.
Partners sign in at the gateway
Verify partners with OpenID Connect, JWTs, signed requests or client certificates with mutual TLS. Accept more than one method on the same Route.
- Your identity providerG8 connects to the identity provider or directory you already run.
Card numbers and tokens kept out of logs
Mask or remove headers, query arguments and body fields in the lines your logger Plugins write.
Every change recorded before it’s applied
Roles per Environment decide who can change Production. The G8 engine checks each change, and G8 records it with the values before and after, with secrets masked.
- Refused attempts tooA change a role doesn’t allow is refused and recorded.
Assistants for staff, with rules
Internal tools reach language models through one Route, with a fallback provider, token budgets and a prompt guard that refuses card numbers.
- Keys at the gatewayProvider keys are set in the Plugin, not in each tool.
How a bank puts G8 to work
A typical setup, drawn to show how the parts fit together. It doesn’t describe a specific customer.
A bank runs payment, account and card APIs for its own channels and for partners. Its teams have started to use language models in internal tools.
Each partner signs in with OpenID Connect or a signed request and gets its own rate limit.
Internal tools reach language models through one Route, with token limits and a fallback provider.
Roles per Environment decide who can change Production, and every change is recorded.