demo: api shield
two api shield demos. schema validation catches malformed or unexpected query parameters before they hit your function. jwt validation catches missing / tampered / expired tokens before they hit your function. both run at cloudflare's edge — the pages functions on the other side never execute for invalid requests.
# pick a demo
schema validation
openapi schema requiring ?id=<uuid>. non-uuid ids return 403 from api shield without touching the function.
jwt validation
mint an rs256 token from /api/get-demo-jwt, call /api/shield-jwt with valid / expired / missing / tampered tokens. api shield validates signature + exp + nbf against the site's jwks.
# how it works together
- you upload (or discover) an openapi schema in api shield
- each path in the schema becomes an operation in endpoint management
- you attach protections to operations: schema validation, jwt validation, rate limiting, sequence detection
- edge nodes evaluate protections before your origin (or pages function) runs
# jwks
the site publishes its jwt signing key at /.well-known/jwks.json.
api shield's token validation config fetches from that url to know which
signatures to accept.