API Gateway Integration with FileMaker

Expert

Place an API gateway (such as AWS API Gateway or Kong) in front of the FileMaker Data API to add rate limiting, request transformation, and centralized authentication.

What you'll learn

The architecture of a gateway in front of the FM Data API
How to use API keys at the gateway instead of FM credentials in clients
How to transform requests and responses at the gateway layer
How to add rate limiting and IP allow-listing at the gateway

Exposing the FileMaker Data API directly to the internet means clients must know your server address and manage FM credentials. Placing an API gateway in front adds a stable public URL, centralizes auth (API keys instead of FM credentials), and lets you add rate limiting and request transformation without changing FileMaker.

1/4

Gateway architecture overview

Clients send requests to the gateway with an API key. The gateway validates the key, maps it to FM credentials, injects the FM session token (maintaining a pool), transforms the request if needed, and forwards to FM Server. The FM server is not exposed to clients.

TEXT

// Request flow:
// Client -> Gateway (API key auth) -> Token pool lookup -> FM Server (Bearer token)

// Gateway config (pseudocode / Kong-style)
routes:
  - path: /v1/contacts
    methods: [GET, POST]
    upstream: https://fm-server.internal/fmi/data/v1/databases/CRM/layouts/Contacts
    plugins:
      - key-auth
      - rate-limiting: { per_minute: 60 }
      - request-transformer:
          add_headers:
            Authorization: "Bearer {{fm_token}}"

Webhook Patterns with FileMaker Building API Middleware for FileMaker