Configure Akamai on Zephyr

We now support Akamai as a cloud provider for Bring Your Own Cloud (BYOC) deployments. Akamai is a cloud platform known for its global content delivery network (CDN), edge computing capabilities, and strong focus on performance and security. Their infrastructure is designed to help organizations build and scale applications closer to end users while maintaining high availability and low latency.

With this integration, you can leverage your existing Akamai infrastructure to run and manage services directly within your own cloud environment, giving you more control, flexibility, and compliance alignment.

Prerequisites

Info

A registered Akamai account, contract must include EdgeWorkers (entitled for the Basic Compute resource tier, ID 100 — see Resource tier) and EdgeKV
A registered Zephyr account
A registered domain
EdgeKV enabled for the Akamai account before the first deployment. Zephyr checks this during setup and initializes EdgeKV when Akamai reports the account as uninitialized.

Configure and enable Akamai

Log in to the Zephyr Dashboard

After signing in, select your organization.

Locate Akamai under Deployment Integration

Select Settings from the top navigation tabs.
On the left sidebar, select Deployment Integration.
Choose Available to find Akamai, then click on Add integration.

Retrieve Credentials and Configure Akamai

Before proceeding, you will need some data from Akamai:

1. API Token

Click on Identity and access in the menu
Click on Create API client
Choose Advanced
Configure required permissions and remove the rest:

API	Access Level
CPcode and Reporting group (cprg)	READ-WRITE
Edge Hostnames API (hapi)	READ-WRITE
EdgeKV	READ-WRITE
EdgeWorkers	READ-WRITE
Property Manager (PAPI)	READ-WRITE

Copy or download token and add [default] as a header, so token will look like:
If your Akamai account uses account switching, include account_key in the same section.

Secure Your Credentials

Keep your API token secure. Never commit credentials to version control or share them publicly.

[default]
client_secret = YOUR_CLIENT_SECRET
host = YOUR_AKAMAI_HOST
access_token = YOUR_ACCESS_TOKEN
client_token = YOUR_CLIENT_TOKEN
# account_key = YOUR_ACCOUNT_KEY

2. Contract id

Click on Contracts in the menu
Find your contract id

3. Group id

Click on Properties in the menu
Numeric value in the url is your group id https://control.akamai.com/apps/property-manager/#/groups/<groupId>/properties
Use a top-level group that has access to EdgeKV, EdgeWorkers, Property Manager, Edge Hostnames, and CPcode resources for the selected contract.

4. Product id

Find your product here and choose the product id matching your contract. Available products: prd_Security_Failover (Security Failover), prd_API_Accel (API Accelerator), prd_Site_Accel (Site Accelerator). For this delivery-property integration, use prd_Site_Accel.

5. Resource tier

Zephyr provisions your EdgeWorker on the Basic Compute resource tier (resourceTierId: 100). Confirm this tier is entitled on the contract you selected above before starting:

Akamai Control Center → Account Admin → Contracts → open your contract → search the product list for EdgeWorkers and check which tier(s) are listed.
Or, with the EdgeWorkers CLI installed, run akamai edgeworkers list-restiers --contractId <your-contract-id> and confirm resourceTierId: 100 (Basic Compute) is in the response.

If your contract is only entitled for Dynamic Compute or Enterprise Compute, EdgeWorker creation fails with an Akamai 403 Forbidden error (errorCode: EW0401, detail: Permission Invalid), even when your API token has the correct EdgeWorkers permission.

Configuration Inputs

Details for each input after clicking Add Integration under Akamai:

Integration Name

A unique name within your organization, used as a slug.

Integration Display Name

The name of the integration shown on the dashboard.

API Token

Obtainable from Akamai. See instructions for creating your API token.

Domain

Your domain.

Akamai contract id

Obtainable from Akamai. See instructions for getting your contract id.

Akamai group id

Obtainable from Akamai. See instructions for getting your group id.

Akamai product id

Obtainable from Akamai. See instructions for getting your product id.

Akamai account key

Optional. Required only when your API client authenticates through an Akamai account-switching context.

Set Integration as Default

When set as default, all Zephyr deployments will use this integration until a new one (default integration) is set. Deployment using integration won't work until Akamai worker and property become activated.

Validate domain and setup DNS

Click on Properties in the menu
Click on your property
Click on active version
Go to section Property hostnames
Click on ... in Actions column near any hostname, click Validate certificate domain and copy CNAME Record value
Go to your domain provider (e.g., GoDaddy)
Add some CNAME records

Subdomain Type Value
_acme-challenge.ze.yourdomain.com CNAME < value from verification record >
ze.yourdomain.com CNAME ze.yourdomain.com.edgesuite.net.
*.ze.yourdomain.com CNAME ze.yourdomain.com.edgesuite.net.

Subdomain	Type	Value
_acme-challenge.ze.yourdomain.com	CNAME	< value from verification record >
ze.yourdomain.com	CNAME	ze.yourdomain.com.edgesuite.net.
*.ze.yourdomain.com	CNAME	ze.yourdomain.com.edgesuite.net.

Wait until worker and property become activated

It may take up to 30 minutes.

Retry after EdgeKV initialization

If setup failed because EdgeKV was not initialized, verify that the API client has EdgeKV READ-WRITE permission and then retry the same integration from Zephyr. Retry reuses the saved Akamai configuration and continues setup after the EdgeKV preflight completes.

Retry after a resource tier error

If setup failed with an Akamai 403 Forbidden error (errorCode: EW0401, detail: Permission Invalid) while creating the EdgeWorker, this usually means the contract isn't entitled for the Basic Compute resource tier Zephyr requests. Verify entitlement with your Akamai account team or the Resource tier check above, then retry the same integration from Zephyr. Retry reuses the saved Akamai configuration.

What Will Be Created on Your Akamai Account?

When Akamai is added as your provider on Zephyr, these properties will be created on your Akamai account:

1. EdgeKV Namespace

ze-yourdomain-com

2. EdgeKV access token

ekv-token-ze-yourdomain-com

3. Workers

ze.yourdomain.com (for uploading and serving assets)

4. Property

ze.yourdomain.com

Clean Uninstall and Reset

Warning

Zephyr Cloud does not manage deletion of API tokens or any Akamai account properties.
Assets and information on your Akamai account are immutable by default. During a clean uninstall, previously deployed assets and information are unrecoverable.

To delete an existing Akamai integration, follow these steps:

Deleting property

Remove CNAME records which have been added here
Click on Properties in the menu
Click on your property
Click on three ... in the Actions column in the active version line
Choose Deactivate Production
Wait until property become deactivated
Go back to properties list
Click on three ... in the Actions column in the your property line
Choose Delete Property

Deleting worker

Click on EdgeWorkers in the menu
Click on your worker
Click on three ... in the Actions column in the active version line
Choose Deactivate version
Wait until version become deactivated
Go back to workers list
Click on three ... in the Actions column in the your worker line
Choose Delete EdgeWorker ID

Remove edge hostname

Click on Edge Hostnames in the menu
Click on three ... in the Actions column in the active version line
Choose Delete Edge Hostname

Remove EdgeKV namespace

Can be done only with Akamai API.

const EdgeGrid = require('akamai-edgegrid');

const { homedir } = require('node:os');
const { promisify } = require('node:util');

const edgercPath = homedir() + '/.edgerc';
const edgercSection = 'default';
const eg = new EdgeGrid({
  path: edgercPath,
  section: edgercSection,
});

const namespaceId = process.env.NAMESPACE;
const network = process.env.NETWORK || 'production'; // staging or production

eg.auth({
  path: `/edgekv/v1/networks/${network}/namespaces/${namespaceId}`,
  method: 'DELETE',
  headers: {
    'Content-Type': 'application/json',
    Accept: 'application/json',
  },
  body: {},
});

const send = promisify(eg.send.bind(eg));
send()
  .then(({ data }) => {
    console.log('Namespace deleting result', data);
  })
  .catch((error) => {
    console.error('Namespace deleting error', error);
    process.exit(1);
  });

Revoke EdgeKV access token

Can be done with Akamai CLI or Akamai API.

const EdgeGrid = require('akamai-edgegrid');

const { homedir } = require('node:os');
const { promisify } = require('node:util');

const edgercPath = homedir() + '/.edgerc';
const edgercSection = 'default';
const eg = new EdgeGrid({
  path: edgercPath,
  section: edgercSection,
});

const tokenName = process.env.TOKEN_NAME;

eg.auth({
  path: `/edgekv/v1/tokens/${tokenName}`,
  method: 'DELETE',
  headers: {
    'Content-Type': 'application/json',
    Accept: 'application/json',
  },
  body: {},
});

const send = promisify(eg.send.bind(eg));
send()
  .then(({ data }) => {
    console.log('Token revoking result', data);
  })
  .catch((error) => {
    console.error('Token revoking error', error);
    process.exit(1);
  });

#Configure Akamai on Zephyr

#Prerequisites

#Configure and enable Akamai

#Log in to the Zephyr Dashboard

#Locate Akamai under Deployment Integration

#Retrieve Credentials and Configure Akamai

#1. API Token

#2. Contract id

#3. Group id

#4. Product id

#5. Resource tier

#Configuration Inputs

#Validate domain and setup DNS

#Wait until worker and property become activated

#Retry after EdgeKV initialization

#Retry after a resource tier error

#What Will Be Created on Your Akamai Account?

#1. EdgeKV Namespace

#2. EdgeKV access token

#3. Workers

#4. Property

#Clean Uninstall and Reset

#Deleting property

#Deleting worker

#Remove edge hostname

#Remove EdgeKV namespace

#Revoke EdgeKV access token