- Home
- API Gateway Software
- Ocelot
Ocelot
What it is
Ocelot is a free, MIT-licensed .NET API gateway for microservices that need one entry point for HTTP and HTTPS services running on ASP.NET Core-supported platforms. It is self-hosted, installed as a NuGet package, and configured as an ASP.NET Core application. Routing supports both static and dynamic routes. Gateway capabilities include caching, request aggregation, authentication, load balancing, rate limiting, logging, and request and response transformations. Documented service-discovery providers include Consul, Kubernetes, Eureka, and Azure Service Fabric. Routes can use ASP.NET Core authentication schemes, including JWT bearer and IdentityServer bearer tokens, and can restrict access by scopes. Documentation includes Auth0 and Okta examples. WebSockets and secure WebSockets are supported. Ocelot targets .NET 8, .NET 9, and .NET 10. It does not directly support GraphQL; the project points developers to GraphQL for .NET. The repository reports no SECURITY.md file and no published security advisories.
For and against
For
- Free, MIT-licensed open-source gateway
- Static and dynamic route support
- Multiple documented service-discovery providers
- JWT and scope-based route controls
- Rate limiting and request transformation
Against
- No direct GraphQL support
- Self-hosted ASP.NET Core deployment required
- Repository reports no SECURITY.md file
The verdict
Ocelot provides a broad gateway feature set for ASP.NET Core microservices, including routing, security, discovery, and traffic management. GraphQL requires a separate integration, and the repository reports no published security advisories.
Who it suits
Ocelot suits developers building self-hosted microservice systems on ASP.NET Core. It is useful when routing, authentication, service discovery, traffic controls, and WebSocket support are needed.
Plans and prices
Ocelot
MIT-licensed open-source .NET API gateway
Read 9 Oct 2026 · github.com
On the record
- Authentication
- Routes can use registered authentication schemes, including JWT bearer schemes, and can restrict access by scopes.ocelot.readthedocs.io · read 9 Oct 2026
- Deployment
- Ocelot is configured and deployed as an ASP.NET Core application, and the documentation includes multiple-instance, Consul, and Service Fabric configurations.ocelot.readthedocs.io · read 9 Oct 2026
- Gateway features
- Listed features include caching, request aggregation, authentication, load balancing, rate limiting, logging, and request and response transformations.github.com · read 9 Oct 2026
- GraphQL limit
- The project says it does not directly support GraphQL and points developers to the GraphQL for .NET library for integration.github.com · read 9 Oct 2026
- HTTP support
- It works with HTTP(S) services on platforms supported by ASP.NET Core.ocelot.readthedocs.io · read 9 Oct 2026
- Integrations
- The authentication documentation includes examples for Auth0 and Okta, and describes using IdentityServer bearer tokens.ocelot.readthedocs.io · read 9 Oct 2026
- License
- The GitHub repository identifies the project license as MIT.github.com · read 9 Oct 2026
- Purpose
- Ocelot is a .NET API gateway for microservices architectures that need a unified point of entry.ocelot.readthedocs.io · read 9 Oct 2026
- Routing
- Its primary features include configuration and routing, with support for static and dynamic routes.ocelot.readthedocs.io · read 9 Oct 2026
- Runtime
- Ocelot targets .NET 8, .NET 9, and .NET 10 and is installed as a NuGet package in an ASP.NET Core project.ocelot.readthedocs.io · read 9 Oct 2026
- Security policy
- The GitHub repository reports that it has not set up a SECURITY.md file and has no published security advisories.github.com · read 9 Oct 2026
- Service discovery
- Documented service discovery providers include Consul, Kubernetes, Eureka, and Azure Service Fabric.github.com · read 9 Oct 2026
- WebSockets
- The documentation lists WebSockets, including secure WebSockets, as supported features.ocelot.readthedocs.io · read 9 Oct 2026
