Nginx

On nginx, D3 Edge runs as a small Lua script in the access phase, before your site sees the request. Per request it extracts metadata, asks the decision service for a decision, then lets the request continue or returns a 403. It holds no state, and if the decision call errors or exceeds its budget your site serves exactly as before.

One thing this install can do that the others can't: on pass it hands the verdict to your upstream as X-D3-Tier and X-D3-Identity request headers, so your application can make its own calls — serve a lighter page to a crawler, skip analytics for bots — with the identity already proven at the edge.

Install

The script, the sample config, and the step-by-step guide live in the adapters repo: github.com/d3-inc/d3-edge-adapters/nginx.

You need nginx with Lua support — OpenResty, or a build with ngx_http_lua_module (Kong and APISIX ship it) — plus the lua-resty-http library. In short: save the script, add the env lines and http {} settings from the sample config plus one access_by_lua_file line per protected location, set the environment variables where nginx starts with your API key in POLICY_ADAPTER_KEY, and reload. The repo README documents every variable — POLICY_WORKER_URL unset means the script is a silent passthrough.

Then verify it worked.

Response shape

Every response carries an x-d3-edge header: disabled, pass, block, fail-open, or fail-closed. A blocked request gets a 403 with a JSON body:

{ "blocked": true, "ruleId": "…", "tier": "…", "identity": "…" }

On pass, your upstream additionally receives the verdict as X-D3-Tier and X-D3-Identity request headers — set by the script on every pass, so a client can't spoof them past it.