Launching today
ApiTraffic
API monitoring, performance, and security for Node.js
2 followers
API monitoring, performance, and security for Node.js
2 followers
ApiTraffic records every request your Node.js API handles: the payload, the database queries behind it and the firewall's verdict. It alerts you when an endpoint breaks, drifts or slows down after a deploy, flags N+1 queries down to the file and line, and blocks bad bots and risky outbound calls inside your app. Redaction runs in your process, so sensitive data never leaves your network. Every failure becomes a paste-ready fix for your AI coding agent.
Payment Required
Launch Team / Built With
CloudflareStill paying to deploy your apps? Try Cloudflare Workers for free
Promoted
Hey Product Hunt 👋
I'm Jason, and I built ApiTraffic.
For years I ran APIs without really knowing what they were doing. A dependency would suddenly break in production and I'd be digging through logs trying to work out which one, and why. I couldn't easily see what was hitting the API either, which made it hard to handle security properly. I only found out something was wrong after it had already gone wrong.
What I learned is that full visibility is what shortens the time to a fix, and setting it up ahead of time saves hours of headache when problems strike. When you can already see every request, every dependency call and every bad actor, an incident becomes a quick lookup instead of an afternoon of guesswork. I built ApiTraffic to give me that visibility, and now I want you to have it too.
Most teams running a Node API end up stitching together a logger, an APM tool, an alerting setup and a WAF. That's four bills and four places to look, and none of them hold the whole story of one request. ApiTraffic keeps one record per request, and every feature reads from it.
What you get from one npm install:
🔍 Every request, every payload, every query. Open any request to see what came in, what went out, and a waterfall of every SQL, cache and outbound call, down to the file and line.
⚡ Performance that names the culprit. Operations are ranked by the time they cost you, and N+1 queries are flagged automatically. Postgres, MySQL, MongoDB, Redis, Kafka, RabbitMQ and outbound HTTP work out of the box.
🚨 Alerts that don't cry wolf. Each endpoint is compared with its own normal, so a real regression opens one incident in Slack, email, PagerDuty, Jira or a webhook. Drift detection catches the deploy that removed a field, and regression tracking ranks what got slower after a release.
🛡️ A firewall inside your app. OWASP managed rules, rate limits, IP and country lists, and bot protection. Start in monitor mode, see exactly what it would have blocked, then enforce.
🔒 Outbound protection. Your app runs a lot of code you never wrote. Allow-list where it can call, refuse payloads carrying credentials or bulk personal data, and get alerted the first time it calls a host it has never called before.
🙈 Privacy levers. Redact in your own process so masked values never leave your network. Credentials are masked by default, and exclusions drop routes before they're sent.
🤖 Fix with AI. Every failure becomes a paste-ready prompt for Claude Code, Cursor or Copilot, and our MCP server lets your agent pull the evidence itself.
Works with Express, Fastify, NestJS, Koa, Hapi, LoopBack, AdonisJS, Sails, Meteor and Strapi, or any stack through a proxy URL.
Try it: free trial, no credit card, and published pricing. You can click around a full sample API before you connect your own.
I'd love your honest feedback, especially on what you'd want to see next and which framework or language we should support after Node. I'll be here all day answering questions. 🙏