Karpov Gateway: Best API Gateway for Backend Teams in 2026

What Is Karpov Gateway?

Karpov Gateway is a MIT-licensed API gateway and control console built by MiChongs in Go and Next.js. Karpov Gateway is one of the best API Gateways tools for backend teams, indie hackers, and CTOs shipping authenticated APIs because it combines REST routing, gRPC microservices, credential pooling, OAuth2 SSO, quota billing, and TOTP in a single repository with 6 core services and a dual-mode deployment layout.

The repo is not a thin reverse proxy. It is a full application platform with a Go backend (Gin + gRPC), a Next.js 16 App Router frontend, PostgreSQL migrations, Redis-backed state, and Docker Compose definitions for local and production runs. If you need an API edge plus admin UX instead of just a proxy config file, Karpov Gateway is built for that exact gap.

Quick Overview

Who Should Use Karpov Gateway?

• Solo builders launching paid APIs who need auth, billing, and quota checks without wiring together Kong, Clerk, Stripe hooks, and a separate admin panel.
• Small platform teams that want gRPC-backed internal services behind one REST edge while keeping the gateway, auth, quota, and billing concerns isolated.
• Security-minded teams that require encrypted token storage, CSRF protection, session cookies, and TOTP before exposing a production console.
• Ops-light startups that prefer Docker Compose and a single codebase over running separate products for gateway, dashboard, and account management.

Not ideal for:

• Teams that only need a generic reverse proxy and already run a mature gateway such as Kong, Tyk, or Envoy.
• Organizations that want a vendor-supported enterprise SLA, compliance paperwork, or managed cloud hosting.
• Projects that do not want to maintain PostgreSQL, Redis, and two application runtimes in the same stack.

Key Features of Karpov Gateway

• Unified REST gateway — Karpov Gateway routes traffic through one front door while splitting business logic into gateway, auth, music, pool, quota, billing, and worker services over gRPC. That gives you independent deployability without forcing every request through one monolith.
• Encrypted credential pool — The credential pool uses KEK + DEK envelope encryption with AES-256-GCM and AAD, and the master key comes from POOL_KEK_HEX. That design keeps stored secrets unreadable if the database leaks, but it also means key rotation has operational consequences.
• Email registration and activation — Karpov Gateway supports SMTP verification codes plus activation links, and it falls back to a LogSender when SMTP is not configured. That makes local development easier while still supporting a production signup flow.
• Linux.do OAuth2 SSO — The OAuth path uses PKCE S256, signed state cookies, and encrypted token storage for login, binding, and unbinding flows. This is the kind of integration you usually end up building by hand in a MachineAuth-style access stack.
• Quota and billing enforcement — PlanQuotaMiddleware applies limits at the gateway layer, then the business service re-checks plan and scope internally. That double check matters when you do not want a single bypass point to become your abuse vector.
• TOTP with replay protection — Karpov Gateway uses pquerna/otp plus Redis-backed replay protection for two-factor authentication. The Redis layer prevents the same code from being accepted twice in a short window.
• Structured audit logging — Audit events are emitted as JSON, separated by type, and rolled daily. That makes log shipping and retention policies easier than parsing ad hoc text logs, especially when paired with OpenTrace for request correlation.
• Modern console stack — The frontend uses Next.js 16 App Router, shadcn/ui, Radix, and Tailwind v4. You get a usable internal console instead of a bare JSON API, which is the right trade when non-engineers need to manage auth, quotas, and user state.

Karpov Gateway vs Alternatives

Pick Karpov Gateway when you want to ship a controlled API surface and you also need the account-management app that sits behind it. Pick Kong when you need a battle-tested gateway standard with a deeper plugin ecosystem and you are fine assembling the console and auth flows yourself. Pick KrakenD when the main requirement is lightweight request aggregation and you do not need a full product UI.

Pick Tyk when your team wants broader governance features, policy management, and a more established API management story. If you are building a custom platform and want tighter control over the auth and billing path than most off-the-shelf gateways expose, Karpov Gateway is the more opinionated fit. For broader automation around release pipelines and service orchestration, a tool like djevops pairs better than trying to force the gateway to act as your deployment system.

How Karpov Gateway Works

Karpov Gateway uses a two-layer architecture: a public REST edge in Go and a set of internal gRPC services for domain-specific work. The gateway process handles ingress concerns such as request routing, CSRF validation, session cookies, quota checks, and auth handoffs, while the internal services own stateful operations like credential pooling, billing, and user lifecycle management.

That split keeps the HTTP boundary narrow and makes the backend easier to reason about. Instead of letting every handler know about storage, encryption, billing, and OAuth callbacks, Karpov Gateway pushes those responsibilities into separate services with protobuf contracts, PostgreSQL schema migrations, and Redis for transient security state. The result is a system that behaves more like a product backend than a simple proxy.

cd gateway
cp .env.example .env

go mod download
go run ./cmd/qqmusic-gateway
# HTTP :8080, gRPC :9000
# first boot prints a superadmin account and temporary password

The command above starts the backend API layer after pulling Go dependencies and loading environment variables. On first boot, Karpov Gateway emits bootstrap credentials so you can log in to the console, then you can wire the web app at http://localhost:3000 to the running gateway.

The design choice that matters most here is the security boundary. Karpov Gateway stores tokens encrypted at rest, uses sid httpOnly cookies plus X-CSRF-Token validation, and puts replay protection in Redis for TOTP. That is a stronger baseline than many starter gateways, but it also means the system expects correct secret management, proper reverse proxy headers, and disciplined config changes.

Pros and Cons of Karpov Gateway

Pros:

• Full-stack control plane — You get gateway logic and an admin UI in one codebase, which shortens integration work for small teams.
• Real security primitives — AES-256-GCM, PKCE, CSRF checks, httpOnly sessions, and Redis replay protection are all present in the default architecture.
• Service separation without vendor lock-in — The internal gateway/auth/quota/billing split is clean enough to deploy parts independently while staying in one repo.
• Production-friendly local stack — Docker Compose, PostgreSQL, and Redis make it straightforward to reproduce the environment on a laptop or a single VM.
• Typed backend contracts — gRPC and protobuf reduce ambiguity between services and make the interface surface explicit.

Cons:

• Operational overhead is non-trivial — You must run PostgreSQL, Redis, Go services, and a Next.js app, which is heavier than a pure proxy config.
• Key management is unforgiving — Changing POOL_KEK_HEX makes old encrypted data unreadable, so secret rotation needs planning.
• Linux.do is a niche SSO provider — The built-in OAuth path is useful for that ecosystem, but most teams will need to implement their own provider flows.
• No managed support layer — Karpov Gateway is open source, so you own upgrades, incident response, and hardening.
• Less ecosystem depth than incumbents — Kong, Tyk, and Envoy have broader community patterns, third-party plugins, and production war stories.

Getting Started with Karpov Gateway

# start dependencies
cd deploy/compose
cp .env.example .env
docker compose up -d

# start backend
cd ../../gateway
cp .env.example .env
go mod download
go run ./cmd/qqmusic-gateway

# start console
cd ../web
cp .env.example .env.local
pnpm install
pnpm dev

After those commands, the gateway listens on :8080 for HTTP and :9000 for gRPC, while the console runs on http://localhost:3000. You need matching PostgreSQL and Redis credentials across the compose stack and the backend .env, and you should set NEXT_PUBLIC_APP_URL correctly before building the web image for production.

For production, the repo expects a stronger secret posture and a reverse proxy in front of the app. If you terminate TLS at Nginx or Caddy, set TRUST_PROXY=true so forwarded protocol headers are honored, and generate a fresh KEK with openssl rand -hex 32 before bringing the stack up.

Verdict

Karpov Gateway is the strongest option for teams that want an API gateway plus a real admin console when they are willing to run PostgreSQL, Redis, and two app runtimes. Its strongest edge is the built-in security and account-management flow; its main caveat is operational complexity. If you want a self-hosted gateway product, choose it.