You are browsing documentation for an outdated plugin version.
Configuration
This plugin is partially compatible with DB-less mode.
Consumers and credentials can be created with declarative configuration.
Admin API endpoints that do POST, PUT, PATCH, or DELETE on credentials are not available on DB-less mode.
Compatible protocols
The Key Authentication - Encrypted plugin is compatible with the following protocols:
grpc
, grpcs
, http
, https
Parameters
Here's a list of all the parameters which can be used in this plugin's configuration:
-
string required
The name of the plugin, in this case
key-auth-enc
.- If using the Kong Admin API, Konnect API, declarative configuration, or decK files, the field is
name
. - If using the KongPlugin object in Kubernetes, the field is
plugin
.
- If using the Kong Admin API, Konnect API, declarative configuration, or decK files, the field is
-
string
The name or ID of the service the plugin targets. Set one of these parameters if adding the plugin to a service through the top-level
/plugins
endpoint. Not required if using/services/{serviceName|Id}/plugins
. -
string
The name or ID of the route the plugin targets. Set one of these parameters if adding the plugin to a route through the top-level
/plugins
endpoint. Not required if using/routes/{routeName|Id}/plugins
. -
boolean default:
true
Whether this plugin will be applied.
-
record required
-
array of type
string
required default:apikey
Describes an array of parameter names where the plugin will look for a key. The client must send the authentication key in one of those key names, and the plugin will try to read the credential from a header, request body, or query string parameter with the same name.
Key names may only contain [a-z], [A-Z], [0-9], [_] underscore, and [-] hyphen.
-
boolean default:
false
An optional boolean value telling the plugin to show or hide the credential from the upstream service. If
true
, the plugin strips the credential from the request (i.e., the header, query string, or request body containing the key) before proxying it.
-
string
An optional string (consumer UUID) value to use as an anonymous consumer if authentication fails. If empty (default), the request will fail with an authentication failure
4xx
. Note that this value must refer to the consumerid
attribute that is internal to Kong Gateway, and not itscustom_id
.
-
boolean default:
true
If enabled (default), the plugin reads the request header and tries to find the key in it.
-
boolean default:
true
If enabled (default), the plugin reads the query parameter in the request and tries to find the key in it.
-
boolean default:
false
If enabled, the plugin reads the request body (if said request has one and its MIME type is supported) and tries to find the key in it. Supported MIME types:
application/www-form-urlencoded
,application/json
, andmultipart/form-data
.
-
boolean default:
true
A boolean value that indicates whether the plugin should run (and try to authenticate) on
OPTIONS
preflight requests. If set tofalse
, thenOPTIONS
requests are always allowed.
-