APIs connect clients, applications, and services, but perimeter-based controls alone do not provide sufficient protection when credentials are compromised or traffic crosses distributed environments. This paper describes the design and implementation of a Zero Trust API gateway developed as an inline policy-enforcement layer for protected services. The prototype is implemented with FastAPI and combines password-based authentication, OAuth sign-in, JSON Web Tokens, time-based one-time-password multi-factor authentication, scoped API keys, refresh-token rotation, and role- and scope-based authorization. Its request pipeline includes IP blocking, request logging, adaptive risk scoring, sliding-window rate limiting, and a rule-based web application firewall. The gateway also provides a reverse-proxy component that resolves registered upstream services, applies destination checks, forwards permitted requests, and records request identifiers and timing information. Additional detection components evaluate behavioral signals, impossible-travel indicators, and per-user anomalies using an Isolation Forest model when the required machine-learning dependency is available. Functional verification covers successful and rejected authentication, authorization boundaries, rate-limit responses, malicious-input detection, and proxy behavior. The available project evidence supports a functional prototype assessment; it does not establish production-scale throughput, statistically measured latency overhead, or resistance to all attack variants. The paper therefore distinguishes implemented controls from deployment requirements and identifies distributed state, stronger upstream connection validation, centralized monitoring, and broader adversarial testing as priorities for future work.

Keywords— Zero Trust Architecture; API Gateway; API Security; Risk-Based Access Control; Web Application Firewall; Anomaly Detection