Plugin License Tiers

Each subscription tier gives you access to a subset of plugins:

Konnect

Konnect allows you to pay only for what you use with flexible pay-as-you-go billing. There are three plugin tiers categorized by pricing models:

Free tier: A selection of our world-class open-source plugins available in Konnect for free.
Paid tier: Plugins developed by Kong that are available for a monthly fee.
Premium tier: Advanced plugins that are available for a monthly fee.

For more information, review the billing page.

If you’re looking for plugin deployment topology compatibility, supported network protocols, and supported entity scopes, see Plugin Compatibility.

Plugin	Free	Paid	Premium
Basic Authentication
HMAC Auth
JWE Decrypt
JWT
Key Auth
LDAP Authentication
LDAP Authentication Advanced
Mutual TLS Authentication
OAuth 2.0 Introspection
OpenID Connect
SAML
Session

Plugin	Free	Paid	Premium
ACL
Canary Release
Forward Proxy Advanced
GraphQL Proxy Caching Advanced
GraphQL Rate Limiting Advanced
Mocking
OAS Validation
Proxy Cache
Proxy Caching Advanced
Rate Limiting
Rate Limiting Advanced
Request Size Limiting
Request Termination
Request Validator
Response Rate Limiting
Route By Header
Upstream Timeout
WebSocket Size Limit
WebSocket Validator
XML Threat Protection

Plugin	Free	Paid	Premium
Correlation ID
DeGraphQL
Exit Transformer
gRPC-gateway
gRPC-Web
jq
Kafka Upstream
Request Transformer
Request Transformer Advanced
Response Transformer
Response Transformer Advanced
Route Transformer Advanced

Free tier: Open-source Kong Gateway plugins. Available in:
- Kong Gateway Free tier (Enterprise package, self-managed)
- Kong Gateway (OSS) (open-source package, self-managed)
Enterprise tier: All Kong plugins. Available in:
- Kong Enterprise (self-managed)

If you’re looking for plugin deployment topology compatibility, supported network protocols, and supported entity scopes, see Plugin Compatibility.

Plugin	Free	Enterprise
Portal Application Registration
Basic Authentication
HMAC Auth
JWE Decrypt
JWT
Kong JWT Signer
Key Auth
Key Authentication - Encrypted
LDAP Authentication
LDAP Authentication Advanced
Mutual TLS Authentication
OAuth 2.0 Authentication
OAuth 2.0 Introspection
OpenID Connect
SAML
Session
Vault Authentication

Plugin	Free	Enterprise
ACL
Canary Release
Forward Proxy Advanced
GraphQL Proxy Caching Advanced
GraphQL Rate Limiting Advanced
Mocking
OAS Validation
Proxy Cache
Proxy Caching Advanced
Rate Limiting
Rate Limiting Advanced
Request Size Limiting
Request Termination
Request Validator
Response Rate Limiting
Route By Header
Upstream Timeout
WebSocket Size Limit
WebSocket Validator
XML Threat Protection

Plugin	Free	Enterprise
Correlation ID
DeGraphQL
Exit Transformer
gRPC-gateway
gRPC-Web
jq
Kafka Upstream
Request Transformer
Request Transformer Advanced
Response Transformer
Response Transformer Advanced
Route Transformer Advanced