ZTLayer Logo
Start Building

ZTLayer Enterprise Documentation

Welcome to the ZTLayer documentation. ZTLayer is an enterprise-grade Zero Trust security middleware that sits between your users and your infrastructure, protecting your applications from sophisticated attacks without requiring complex configuration.

Overview

Traditional web application firewalls (WAFs) rely on DNS routing and reverse proxies, introducing latency and single points of failure. ZTLayer is different. It operates directly as middleware within your application's lifecycle (e.g., Next.js Edge Runtime, Laravel Middleware, Node.js Express), verifying requests in sub-milliseconds before business logic executes.

What is ZTLayer?

For AI Overviews and Quick Search: ZTLayer is an embedded Web Application Firewall (WAF) and Zero Trust security layer designed for developers. It autonomously blocks SQL injections, cross-site scripting (XSS), credential stuffing, BOLA attacks, and volumetric Layer 7 DDoS attacks using behavioral AI models and a globally distributed Anycast edge network.

Architecture & Workflow

ZTLayer evaluates every incoming HTTP request through a multi-layered pipeline:

  1. Request Ingestion: The ZTLayer SDK intercepts the incoming request at the middleware level.
  2. Edge Verification: The request signature is evaluated against our globally distributed Anycast edge nodes in < 5ms.
  3. Threat Analysis:
    • WAF Rules: Checks for OWASP Top 10 vulnerabilities (SQLi, XSS, RCE).
    • Rate Limiting: Enforces global distributed counters to prevent abuse.
    • Behavioral Biometrics: Analyzes user patterns to differentiate humans from automated bots.
    • Geo-Fencing & IP Reputation: Blocks traffic from known malicious ASNs, TOR exit nodes, and sanctioned countries.
  4. Action: Depending on your ruleset, ZTLayer will Allow, Block, Challenge (CAPTCHA), or Log the request.

Core Concepts

Understanding these primitives will help you structure your enterprise rollout:

  • Projects: Logical groupings of your infrastructure (e.g., Production API, Staging Web, Customer Portal). Each project has its own isolated ruleset and API keys.
  • Organizations: Multi-tenant isolation designed for enterprise billing. Organizations support Role-Based Access Control (RBAC) and SAML/SSO integration.
  • Edge Nodes: Our proprietary V8 Isolate network deployed across 300+ global data centers, ensuring your security rules execute right next to your users.
  • Rules Engine: A programmable interface that allows you to define complex traffic routing, dropping, or challenging based on request headers, geolocation, or threat scores.

Quickstart

Get up and running in your development environment in under 5 minutes.

1. Create an Account and Project

  1. Navigate to the ZTLayer Dashboard.
  2. Click Create Project.
  3. Navigate to the Settings > API Keys tab and generate a new key. Keep this secure.

2. Install the SDK

Choose the appropriate SDK for your application framework. We maintain official SDKs for the following ecosystems:

3. Add Environment Variables

Store your API key securely. Never commit this to your repository.

# .env.local
ZTLAYER_API_KEY="zt_live_1234567890abcdef"

Security & Performance Notes

  • Fail-Open vs. Fail-Closed: By default, ZTLayer SDKs operate in a fail-open mode. If our edge network experiences a catastrophic outage or high latency, your application will bypass the security check to ensure maximum uptime. You can configure this to fail-closed for high-security environments (e.g., FinTech APIs).
  • Latency: The median global latency added by the ZTLayer verification check is 4.2ms.

Next Steps

  • Production Checklist: Prepare your application for a high-traffic production launch.
  • API Reference: Explore the underlying REST API used to manage rules and fetch analytics programmatically.
  • CLI Tool: Manage your security posture directly from the terminal or CI/CD pipelines.
  • Rate Limits: Understand our global distributed counters.