Your spec is your gateway.
Barbacane is a spec-driven API gateway built in Rust. Point it at an OpenAPI or AsyncAPI spec and it becomes your gateway — routing, validation, authentication, and all. No proprietary config language, no drift between your spec and your infrastructure.
- Spec as config — Your OpenAPI 3.x or AsyncAPI 3.x specification is the single source of truth. No separate gateway DSL to maintain.
- Fast and predictable — Built on Rust, Tokio, and Hyper. No garbage collector, no latency surprises.
- Secure by default — Memory-safe runtime, TLS via Rustls, sandboxed WASM plugins, secrets never baked into artifacts.
- Edge-ready — Stateless data plane instances designed to run close to your users, with a separate control plane handling compilation and distribution.
- Extensible — Write plugins in any language that compiles to WebAssembly. They run in a sandbox, so a buggy plugin can't take down the gateway.
- Observable — Prometheus metrics, structured JSON logging, and distributed tracing with W3C Trace Context and OTLP export.
# Clone and build
git clone https://github.com/barbacane-dev/barbacane.git
cd barbacane
cargo build --release
# Compile your OpenAPI spec
./target/release/barbacane compile --spec api.yaml --manifest barbacane.yaml --output api.bca
# Run the gateway
./target/release/barbacane serve --artifact api.bca --listen 0.0.0.0:8080Full documentation is available at docs.barbacane.dev.
- Getting Started — First steps with Barbacane
- Spec Configuration — Configure routing and middleware
- Middlewares — Authentication, rate limiting, caching
- Dispatchers — Route requests to backends
- Control Plane — REST API for spec and artifact management
- Web UI — Web-based management interface
- Plugin Development — Build custom WASM plugins
- Development Guide — Setup and contribute
| Plugin | Type | Description |
|---|---|---|
http-upstream |
Dispatcher | Reverse proxy to HTTP/HTTPS backends |
mock |
Dispatcher | Return static responses |
lambda |
Dispatcher | Invoke AWS Lambda functions |
jwt-auth |
Middleware | JWT token validation |
apikey-auth |
Middleware | API key authentication |
oauth2-auth |
Middleware | OAuth2 token introspection |
rate-limit |
Middleware | Sliding window rate limiting |
cache |
Middleware | Response caching |
cors |
Middleware | CORS header management |
Benchmark results on Apple M4 (MacBook Air 16GB):
| Operation | Latency |
|---|---|
| Route lookup (1000 routes) | ~83 ns |
| Request validation (full) | ~1.2 µs |
| Body validation (JSON) | ~458 ns |
| Router build (500 routes) | ~130 µs |
Run your own benchmarks:
cargo bench --workspaceBarbacane is under active development. See MILESTONES.md for the roadmap and CHANGELOG.md for release history.
Contributions are welcome! Please read CONTRIBUTING.md for guidelines.
Apache 2.0 — see LICENSE for details.
Barbacane is a trademark. The software is open source; the brand is not. See TRADEMARKS.md for usage guidelines.