API gateway and Zuplo

The website does not need an API gateway in front of its own traffic. The full decision record lives with the gateway repo: When to use Zuplo.

How the site handles what a gateway would do

  • Hiding keys: third-party calls run in Next.js server routes or server actions on Vercel, or in Convex actions. Keys stay in Vercel or Convex environment variables.

  • Rate limits: Vercel Firewall rate-limit rules (and @vercel/firewall in route code) at the edge; @convex-dev/rate-limiter inside Convex functions.

  • Auth: Better Auth, integrated with Convex through ctx.auth.

Vercel’s AI Gateway only routes LLM requests; it is not a general API gateway.

Rules

  • Call Convex directly from the browser and server. Never proxy Convex through Zuplo.

  • New third-party integrations go in a Convex action or a Next.js server route, not in the Zuplo gateway.

Current gateway use and migration

Today only the site’s server actions and the client check-in store call the food-truck-api gateway (Places search, trucks and check-ins). The mobile app does not call it.

  1. Move Places search into a Convex action.

  2. Move trucks and check-ins from Firestore into Convex.

  3. Remove the gateway calls from the site, then retire or park the gateway.

Zuplo comes back into scope only for a public or partner API (issued API keys, per-consumer quotas, monetization, a developer portal).