## Executive Summary

### Aperture (Lightning Labs)

Focus: L402 payments only

Target: Developers, hobbyists

Status: Community maintained, limited updates

Lightning: LND only

### SatGate Gateway

Focus: Protection + Payments ("Protect & Pay")

Target: Enterprise, AI/Agent platforms

Status: Active development

Lightning: Phoenixd, LND, CLN, Alby, LNbits, Strike

## Feature Comparison

Feature | Aperture | SatGate Gateway
--- | --- | ---
L402 Lightning Payments | ✓ | ✓
Capability Tokens (no payment) | ✗ | ✓
Chargeback/Showback Mode | ✗ | ✓
Fiat402 (JWT receipts) | ✗ | ✓
Multi-tenant Isolation | ✗ | ✓
Token Governance (ban/lineage) | ✗ | ✓
Admin Dashboard UI | ✗ | ✓
SCIM 2.0 Provisioning | ✗ | ✓
GitOps Signed Configs | ✗ | ✓
Audit Logging (WORM) | ✗ | ✓
Budget Management | ✗ | ✓
Rate Limiting | Basic | ✓ Per-route, Redis HA
mTLS to Upstreams | ✗ | ✓
Circuit Breaker | ✗ | ✓
Prometheus Metrics | Basic | ✓ Full observability
Helm Chart | Community | ✓ Official
Client SDKs | Go only | ✓ Go, Node.js, Python
Supply Chain Security | ✗ | ✓ Cosign, SBOM, attestations

## Architecture Comparison

#### 🟠 Aperture

    ┌─────────────────────────────────┐
    │          APERTURE               │
    ├─────────────────────────────────┤
    │  ┌──────────────┐               │
    │  │   L402 Proxy │               │
    │  │  (pay only)  │               │
    │  └──────────────┘               │
    │         │                       │
    │  ┌──────┴──────┐                │
    │  │  LND only   │                │
    │  │  (coupled)  │                │
    │  └─────────────┘                │
    └─────────────────────────────────┘

#### 🟢 SatGate Gateway

    ┌─────────────────────────────────┐
    │       SATGATE GATEWAY           │
    ├─────────────────────────────────┤
    │  Protection │ Payments │ Gov    │
    │  (Capability)│(L402/Fiat)│(Audit)│
    ├─────────────────────────────────┤
    │  Pluggable Lightning Providers  │
    │  Phoenixd│LND│CLN│Alby│Strike   │
    ├─────────────────────────────────┤
    │  Enterprise Infrastructure      │
    │  Postgres│Redis│Prometheus│SCIM │
    └─────────────────────────────────┘

## Key Benefits of SatGate Gateway

#### 🛡️ Protection by Default

- Start with capability tokens (API security)
- No procurement friction - payments optional
- Add monetization when business model proven
- Aperture forces payment decision upfront

#### 🔐 Enterprise Security

- Tamper-evident audit logs with hash chains
- Token ban/revocation capabilities
- Token lineage tracking for compliance
- SCIM 2.0 user provisioning
- Signed config enforcement via GitOps
- WORM export for regulatory compliance

#### 💰 Flexible Payment Modes

- Capability: Free but authenticated
- Chargeback: Metered, billed internally
- L402: Pay-per-request with Lightning
- Fiat402: JWT receipts, enterprise billing
- Per-route payment policy configuration

#### 🏢 Multi-Tenant Design

- Full tenant isolation out of the box
- Per-tenant budgets and quotas
- Trusted proxy header enforcement
- Aperture: Single tenant only

#### ⚙️ Operational Excellence

- Full Admin Dashboard UI
- Config generator (YAML, Helm, Env)
- Preflight enterprise readiness checks
- One-click support bundle diagnostics
- Documented backup/restore runbooks

#### ⚡ Lightning Flexibility

- Phoenixd (recommended for simplicity)
- LND (full node)
- Core Lightning (CLN)
- Alby (custodial)
- LNbits, Strike, and more

## When to Use Each

Use Case | Recommended
--- | ---
Simple hobby project with LND | Either
Quick L402 demo | Either
Enterprise API monetization | SatGate Gateway
Multi-tenant SaaS platform | SatGate Gateway
AI Agent authentication | SatGate Gateway
FinOps / chargeback tracking | SatGate Gateway
Compliance requirements (SOC2, audit) | SatGate Gateway
Production deployment with SLAs | SatGate Gateway

## Migration from Aperture

#### Drop-in Compatible Configuration

Aperture config:

    services:
      - name: myapi
        price: 100

SatGate Gateway equivalent:

    routes:
      - name: myapi
        match:
          pathPrefix: /
        upstream: http://myapi:8080
        policy:
          kind: l402
          priceSats: 100

💡 Wire Compatibility: SatGate maintains L402 wire compatibility—existing macaroon clients work unchanged. You can migrate incrementally, route by route.

## Configuration Examples

#### Flexible Per-Route Policies

    routes:
      # Free tier - authenticated but no payment
      - name: free-api
        match: { pathPrefix: /api/v1/free }
        upstream: http://api:8080
        policy:
          kind: capability
          scopes: [api:read]

      # Internal chargeback - metered for FinOps
      - name: internal-api
        match: { pathPrefix: /api/v1/internal }
        upstream: http://api:8080
        policy:
          kind: pay
          pay:
            mode: chargeback
            price: 10
            unit: credits
            costCenterHeader: X-Cost-Center
            enforceBudget: true

      # Premium - pay with Lightning
      - name: premium-api
        match: { pathPrefix: /api/v1/premium }
        upstream: http://api:8080
        policy:
          kind: pay
          pay:
            mode: l402
            price: 100
            unit: sats