The Scepter

What it is

The Scepter sits in front of your APIs. It counts requests, checks a token, and can refuse a body that does not match a schema. Use it with Portcullis on login so password guessing is slower.

Cloudflare analogue: Cloudflare API Shield / Rate Limiting. SLA 99.95% · p99 6ms. Operators write policies. Admins set the default quota.

• ▸Token checks
• ▸Limits per route
• ▸Body shape checks
• ▸Abuse lists

How it works

Default quota applies to unmatched API paths. Route policies override it per method and path.

Actions: throttle, block, or challenge via Portcullis.

Use cases

Concrete ways teams use this service on day one.

Set it up in the dashboard

Dashboard → Services → The Scepter. Add a route quota. Match the most specific path first.

API

Control-plane: GET|POST|DELETE /api/v1/scepter/policies. Send Authorization: Bearer tz_live_YOUR_TOKEN.

Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.

curl -sS -X POST https://tinyzipper.com/api/v1/scepter/policies \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"name":"Auth","path":"/api/v1/auth/*","method":"POST","limit_count":20,"window_seconds":60,"action":"challenge"}'

const res = await fetch("https://tinyzipper.com/api/v1/scepter/policies", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json"
  }
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

Tips

Free includes a handful of policies. Starter is enough for a typical product API.

• ▸SOC 2
• ▸OWASP API

Runbook

Pair with Portcullis on login routes. Quotas are per path.