<![CDATA[Abstract The increasing reliance on Application Programming Interfaces (APIs) in digital banking has expanded the attack surface of distributed systems, exposing limitations in traditional perimeter-based security models within cloud-native environments. This study aims to develop a Cloud-native Zero Trust API Gateway architecture that enables secure, scalable, and compliant API communication in digital banking ecosystems. A qualitative research approach was employed using a systematic literature review combined with architectural synthesis and expert validation to identify key security requirements and design principles. The findings demonstrate that integrating Zero Trust principles such as continuous authentication, identity-centric access control, least-privilege enforcement, and micro-segmentation into cloud-native components, including API Gateways, service meshes, and identity management systems, enables consistent, multi-layered security enforcement across distributed services. The proposed model further aligns security controls with international standards, including OWASP API Security Top 10, PCI DSS, and ISO/IEC 27001, reducing fragmentation between regulatory compliance and architectural implementation. This study concludes that embedding Zero Trust Architecture (ZTA) principles within a cloud-native API Gateway provides a unified and adaptive security framework capable of addressing the dynamic and complex security challenges of modern digital banking systems. Keywords: API; API Gateway; Cloud-native; Digital Banking; Zero Trust Architecture (ZTA).]]>
Copyrights © 2026
