Ocelot
Ocelot is a free, open-source .NET API gateway for microservices, providing a shared entry point for HTTP and HTTPS services on platforms supported by ASP.NE…
What Ocelot is
Ocelot is a free, open-source .NET API gateway for microservices, providing a shared entry point for HTTP and HTTPS services on platforms supported by ASP.NET Core. It is installed as a NuGet package in an ASP.NET Core project and deployed as a self-hosted application. Developers can configure static or dynamic routes and use gateway features such as caching, request aggregation, authentication, load balancing, rate limiting, logging, and request and response transformations. It supports WebSockets, including secure WebSockets, and service discovery providers including Consul, Kubernetes, Eureka, and Azure Service Fabric. Routes can use registered ASP.NET Core authentication schemes, including JWT bearer tokens, and restrict access by scopes. Documentation also covers Auth0, Okta, and IdentityServer bearer tokens. Ocelot targets .NET 8, .NET 9, and .NET 10. It does not directly support GraphQL; the project points developers to GraphQL for .NET for integration. The repository identifies the license as MIT and reports no SECURITY.md file or published security advisories.
Good
- Free and MIT-licensed open-source software.
- Supports static and dynamic routes.
- Includes rate limiting and request transformations.
- Supports WebSockets and secure WebSockets.
- Documents four service discovery providers.
Watch out
- Does not directly support GraphQL.
- Requires deployment as an ASP.NET Core application.
- Repository reports no SECURITY.md file or published advisories.
Who it suits
Ocelot suits developers building microservices on ASP.NET Core who want a self-hosted gateway with routing, authentication, and service discovery. It may also fit teams using the documented .NET runtimes and providers.
Verdict
Ocelot provides a broad set of gateway capabilities for ASP.NET Core microservices without a listed price. Teams needing direct GraphQL support should account for the stated limitation and integration route.
Plans and prices
From Ocelot's own pricing page, checked 9 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Ocelot | Free | MIT-licensed open-source .NET API gateway |
The facts
Each one read from Ocelot's own pages, with the date it was checked.
What it does
- Authentication
- Routes can use registered authentication schemes, including JWT bearer schemes, and can restrict access by scopes.checked 9 Oct 2026
- Deployment
- Ocelot is configured and deployed as an ASP.NET Core application, and the documentation includes multiple-instance, Consul, and Service Fabric configurations.checked 9 Oct 2026
- Gateway features
- Listed features include caching, request aggregation, authentication, load balancing, rate limiting, logging, and request and response transformations.checked 9 Oct 2026
- GraphQL limit
- The project says it does not directly support GraphQL and points developers to the GraphQL for .NET library for integration.checked 9 Oct 2026
- HTTP support
- It works with HTTP(S) services on platforms supported by ASP.NET Core.checked 9 Oct 2026
- Integrations
- The authentication documentation includes examples for Auth0 and Okta, and describes using IdentityServer bearer tokens.checked 9 Oct 2026
- License
- The GitHub repository identifies the project license as MIT.checked 9 Oct 2026
- Purpose
- Ocelot is a .NET API gateway for microservices architectures that need a unified point of entry.checked 9 Oct 2026
- Routing
- Its primary features include configuration and routing, with support for static and dynamic routes.checked 9 Oct 2026
- Runtime
- Ocelot targets .NET 8, .NET 9, and .NET 10 and is installed as a NuGet package in an ASP.NET Core project.checked 9 Oct 2026
- Security policy
- The GitHub repository reports that it has not set up a SECURITY.md file and has no published security advisories.checked 9 Oct 2026
- Service discovery
- Documented service discovery providers include Consul, Kubernetes, Eureka, and Azure Service Fabric.checked 9 Oct 2026
- WebSockets
- The documentation lists WebSockets, including secure WebSockets, as supported features.checked 9 Oct 2026
