Routes connect a public path to one declared application binding. The Gateway terminates HTTP and TLS, applies limits and security policy, then projects the request into content, API, WebSocket, or server-sent event behavior.
Declare routes
{
"services": [
{ "name": "requests", "primitive": "queue" },
{ "name": "updates", "primitive": "queue" },
{ "name": "sessions", "primitive": "queue" },
{ "name": "web-assets", "primitive": "blob" }
],
"applications": [{
"name": "storefront",
"artifact_key": "apps/storefront@v1",
"artifact_sha256": "0000000000000000000000000000000000000000000000000000000000000000",
"bindings": [
{ "handle": "requests", "kind": "queue", "service": "requests" },
{ "handle": "updates", "kind": "queue", "service": "updates" },
{ "handle": "sessions", "kind": "queue", "service": "sessions" },
{ "handle": "web-assets", "kind": "blob", "service": "web-assets" }
],
"routes": [
{ "prefix": "/api/", "binding": "requests", "kind": "api" },
{ "prefix": "/events", "binding": "updates", "kind": "stream" },
{ "prefix": "/socket", "binding": "sessions", "kind": "ws" },
{
"prefix": "/",
"binding": "web-assets",
"kind": "content",
"key_prefix": "site/",
"public": true
}
]
}]
}Use the most specific API paths before a catch-all content route. Forward only
headers your application actually needs, such as accept,
mcp-protocol-version, or a provider signature header.
Route security
You can attach a per-minute token bucket to each API route with
rate_limit_per_min. Secure response headers and cookies are emitted through
the response metadata contract rather than string-concatenated by a proxy.
Unknown bindings and undeclared forwarded request headers fail closed.
Public content routes can serve an Astro or Vite build from Object Storage. API routes use request/reply queues, allowing the Gateway and function tier to scale independently.
See Rate Limits, Headers & Cookies, and Webhooks.