Skip to content
AnyLB

Product capabilities

Everything a global API edge needs, and nothing it does not

AnyLB combines Cloudflare's anycast network with a routing engine, a failover controller and a log pipeline designed for HTTP/HTTPS APIs. Here is exactly what you get.

Start freeRead the docs

Nearest-region routing

The shortest path is the fastest path

Every request enters Cloudflare's network at the point of presence closest to the user, then AnyLB chooses the origin with the lowest live round-trip time. No geographic guesswork, no static weights that drift out of date.

  • Anycast entry from 330+ cities in 125+ countries
  • Origin selection based on rolling RTT and error rate, refreshed continuously
  • Sticky sessions, consistent hashing and session affinity where you need them
  • Per-route strategy overrides for read-heavy and write-heavy endpoints
live rtt rankingselected
  • sin → api-sin118ms
  • fra → api-fra124ms
  • iad → api-iad131ms
  • gru → api-iad146ms

recalculated every 250 ms

Sub-second failover

A failover timeline you can put in a postmortem

Health probes run from at least three regions every two seconds, so a single vantage point can never declare an origin dead on its own. When a pool member degrades, AnyLB drains it and redistributes traffic without waiting for DNS.

  • Multi-region consensus before an origin is marked unhealthy
  • Automatic drain, weighted redistribution and gradual recovery
  • Circuit breaking with configurable retry budgets
  • Deploy and maintenance windows that drain without dropping requests
failover timeline
  1. T+0 ms

    Origin starts failing

    iad-1 begins returning 503 on /healthz for two consecutive probes.

  2. T+2,000 ms

    Failure confirmed

    Three of three probe regions report unhealthy. The origin enters drain state.

  3. T+2,400 ms

    Traffic redistributed

    New connections shift to sin-1 and fra-1 using refreshed weights.

  4. T+2,900 ms

    Everything is on the record

    Alerts fire, dashboards update, and the reroute appears in per-request logs.

Full-fidelity logs

Logs that answer why, not just what

Most load balancers give you counters. AnyLB gives you the request itself: which edge handled it, which origin answered, how long it took, and every retry that happened along the way.

  • Structured per-request logs with a stable, documented schema
  • Stream to S3, GCS, Datadog, Splunk or any HTTP collector in real time
  • Query 30 days of history from the console and export the results
  • Native Prometheus metrics for dashboards and SLO alerting
log schema (excerpt)
timestamp
rfc3339Edge clock, millisecond resolution
status
integerStatus code returned to the client
origin_latency_ms
floatTime to first byte from the selected origin
edge_region
stringCloudflare PoP that handled the request
retry_chain
arrayEvery origin attempted, in order, with the outcome
cache_state
enumhit, miss, revalidated or bypass

Security

Enterprise controls without the enterprise drag

Your origins stay private, certificates renew themselves, and attack traffic is absorbed long before it reaches your infrastructure.

  • TLS 1.3 at the edge with managed certificates and automatic renewal
  • L3–L7 DDoS mitigation included on every plan
  • mTLS or signed-header authentication to your origins
  • Audit logs, SSO and IP allow lists on Enterprise

Security

  • Automatic edge TLS

    Certificates are issued, rotated and renewed for you, including custom hostnames.

  • DDoS mitigation

    Volumetric and application-layer attacks are absorbed across the anycast network.

  • Private origin access

    Authenticate every request to your origin with mTLS or a signed header so nothing bypasses AnyLB.

  • Least-privilege access

    Role-based permissions, scoped API tokens and full audit trails for every configuration change.

Platform

One control plane for every environment

Describe staging and production with the same primitives, keep them in the same repository, and promote a change by merging a pull request.

  • Terraform provider, REST API and CLI backed by the same state
  • Environment promotion with diffable, reviewable configuration
  • Instant configuration rollback to any previous revision
  • Webhooks for every lifecycle event
hcl
resource "anylb_pool" "api" {  name     = "api-prod"  strategy = "latency"   origin {    address = "api-sin1.internal"    weight  = 100  }   origin {    address = "api-fra1.internal"    weight  = 100  }   health_check {    path                = "/healthz"    interval_seconds    = 2    timeout_seconds     = 1    unhealthy_threshold = 2  }} resource "anylb_load_balancer" "api" {  hostname = "api.example.com"  pool_ids = [anylb_pool.api.id]}

Integrations

Fits the toolchain your team already runs

AnyLB writes into the systems you use to ship, observe and respond. Nothing here requires a custom adapter.

Infrastructure as code

  • Terraform
  • Pulumi
  • GitHub Actions
  • GitLab CI

Observability

  • Prometheus
  • Grafana
  • Datadog
  • OpenTelemetry
  • Splunk

Incident response

  • Slack
  • PagerDuty
  • Opsgenie
  • Webhooks

Identity

  • Okta
  • Microsoft Entra ID
  • Google Workspace
  • SAML 2.0

See it running against your own API

Point a staging hostname at AnyLB and watch the routing decisions, health checks and log lines in real time. The free tier is enough to prove it out.

Start freeTalk to sales

No credit card · 5-minute setup · Cancel any time