Piko

What it does

Authentication

Piko can verify client JWTs using HMAC, RSA, or ECDSA keys, with optional endpoint access restrictions in JWT claims.checked 4 Oct 2026

Deployment

Piko can be downloaded as a binary, built from source, or run as a Docker image.checked 4 Oct 2026

Getting started

The maker's getting-started guide demonstrates a three-node Piko cluster behind an NGINX load balancer using Docker Compose.checked 11 Oct 2026

HTTP routing

HTTP(S) requests select an endpoint using either the Host header or the x-piko-endpoint header.checked 11 Oct 2026

Integrations

Piko provides a Go SDK and documents hosting behind a Kubernetes Gateway or HTTP load balancer.checked 4 Oct 2026

Intended use

The project describes use cases including exposing services in a customer network, bring-your-own-cloud services, and connecting to user devices.checked 4 Oct 2026

Kubernetes hosting

Piko is designed to run behind an HTTP load balancer or Kubernetes Gateway, including as a StatefulSet.checked 11 Oct 2026

License

The project is released under the MIT License.checked 11 Oct 2026

Load balancing

Requests are load balanced among available upstreams listening on the same endpoint.checked 11 Oct 2026

Notable TCP limit

Raw TCP requests cannot identify a target endpoint at the Piko server, so they must connect through Piko forward or the Go SDK.checked 11 Oct 2026

Observability

Piko provides a Prometheus endpoint, access logging, and a status API for monitoring and debugging.checked 11 Oct 2026

Outbound tunnels

Upstream services open outbound-only connections to Piko, which forwards incoming traffic through those connections.checked 11 Oct 2026

Production scaling

Piko is designed to run as a cluster for fault tolerance, horizontal scaling, and zero-downtime deployments.checked 11 Oct 2026

Production use

The server can run as a cluster of nodes for fault tolerance, horizontal scaling, and zero-downtime deployments.checked 4 Oct 2026

Protocols

Piko supports HTTP, HTTPS, and TCP traffic.checked 4 Oct 2026

Purpose

Piko is an open-source reverse proxy for tunneling traffic to services that are not publicly routable.checked 11 Oct 2026

Routing

Requests can target endpoints using the Host header or x-piko-endpoint header, and requests to endpoints with multiple upstreams are load balanced.checked 4 Oct 2026

Security

The maker describes Piko as providing a secure way to connect to services that are not publicly routable, and documents TLS support for Piko forward.checked 11 Oct 2026

Support

The project directs users to GitHub Discussions for questions, help, and ideas.checked 11 Oct 2026

TCP routing

TCP traffic can be forwarded with Piko forward or the Go SDK, and Piko forward can authenticate to the server and use TLS.checked 11 Oct 2026

Traffic types

The Piko agent supports HTTP and TCP upstreams, and a Go SDK can create listeners directly from an application.checked 11 Oct 2026

Upstream connections

Upstream services connect outbound to Piko, so they do not need a publicly accessible route.checked 4 Oct 2026

What it does

Piko is a reverse proxy that tunnels traffic to services that are not publicly routable.checked 4 Oct 2026