Dedicated Gateways

A gateway is the plain-HTTP door into IPFS: a server that fetches content from the network so a browser doesn't need to run a node. Anyone can use a public gateway, and for casual reads that's fine. The problem shows up the moment you depend on one - public gateways rate-limit, throttle, and go down, and none of them owes you anything.

Ekayana runs its own. Content you store here is served from infrastructure that pins it, which means the gateway isn't hunting the DHT for your blocks - it already has them. That, more than any caching trick, is why dedicated gateways are fast.

What you get beyond speed: edge caching, a 99.9% uptime SLA on dedicated plans, custom domains with automatic SSL, private gateways with real access control, and per-gateway analytics (requests, bandwidth, geography).

Gateway URLs

Setting up a custom domain

Add the domain in the dashboard, point a CNAME at the gateway, verify ownership, and wait for SSL provisioning - usually five to ten minutes. The DNS record looks like:

Type: CNAME
Host: gateway.example.com
Value: custom-gw.ekayana.com
TTL: 3600

Private Gateways

Not everything should be readable by whoever finds the CID. A private gateway accepts three kinds of credential:

• a session token - an ML-DSA-87 bearer token identifying the account (see Authentication),
• a UCAN capability - a scoped, revocable grant over one CID, presented in the X-UCAN-Token header (see Sharing & Delegation),
• or plain IP allowlisting for infrastructure that can't hold tokens.

The platform issues no API keys. Both credentials above expire and the capability form is revocable, so a leaked credential has a bounded blast radius. See Sharing & Delegation for the reasoning.

Example: Accessing Private Content

// Owner access - the session token alone is sufficient.
const response = await fetch(
  'https://api.ekayana.com/api/download/QmExampleCID123',
  { headers: { Authorization: `Bearer ${token}` } }
);

const data = await response.blob();

To read content someone shared with you, add the capability alongside your session token:

const response = await fetch(
  'https://api.ekayana.com/api/download/QmExampleCID123',
  {
    headers: {
      Authorization: `Bearer ${token}`,
      'X-UCAN-Token': ucanToken,
    },
  }
);

Getting the most out of a gateway

Prefer the subdomain URL form, browsers treat each CID as its own origin, so one page's scripts can't reach another's storage. Enable edge caching for anything fetched repeatedly. For large files, chunked content lets clients range-request instead of downloading everything, and compressing before upload is still worth it: IPFS deduplicates, but it doesn't compress for you.