Choosing and configuring APISIX authentication plugins and consumer design: API keys, JWT, HMAC, LDAP, OpenID Connect, client certificates, external auth services and access restrictions.
Issuing and checking API keys at the gateway: key-auth header and query settings, hiding keys from upstreams, anonymous consumers with lower limits, encrypted storage, Vault references and rotating keys without downtime.
Validating JWTs issued by your own services with jwt-auth: algorithms, where tokens are read from, consumer keys and public keys, exp and nbf checks, clock skew, and the breaking changes from 3.11 to 3.17.
Signing partner and machine requests with hmac-auth: allowed algorithms, signed headers and the Date requirement, clock skew, body digest validation, the key_id credential and migrating from the pre-3.11 plugin.
Authenticating API callers against Active Directory or OpenLDAP at the gateway: ldap-auth consumers and bind DNs, TLS verification now enforced in 3.18, escaping DNs, and when OIDC through an identity provider is the better route.
Delegating authentication decisions to your own auth service with forward-auth: which headers it receives, passing identity headers to upstreams, timeouts and failure codes, degradation settings and latency cost per request.
Modeling API clients in APISIX: consumers per application or partner, separate credentials, consumer groups for shared limits, plugin precedence, duplicate key rejection in 3.18 and lifecycle automation through the Admin API.
Limiting which consumers can call which routes: consumer-restriction and acl plugins, combining them with authentication, per-route allow lists, consumer labels and testing denials before rollout.
Requiring client certificates for partner and service traffic: client CA and chain depth on SSL objects, SNI matching, mTLS on TCP stream routes, certificate rotation and mapping certificates to consumers.
Choosing how APISIX validates OAuth access tokens: introspection calls to the identity provider versus local signature checks with JWKS or a public key, revocation, latency, issuer and audience checks, and fail-closed behavior.
Putting a login in front of internal web apps with the openid-connect authorization code flow: session secrets, PKCE, logout and token revocation, passing identity headers upstream, and standalone mode settings.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.