Integration pages for the APISIX plugins and discovery modules that connect the gateway to identity, policy, secrets, observability and logging systems, based on the APISIX plugin documentation.
Using Keycloak Authorization Services behind APISIX with the authz-keycloak plugin: resource and scope policies, enforcing versus permissive mode, token grants, and how it pairs with openid-connect login. Goes beyond the general SSO page into fine-grained API authorization.
Moving API authorization decisions into Rego policies with the APISIX opa plugin: what request, route and consumer data reaches OPA, the allow response contract, custom denial responses, and running OPA next to the gateway.
Keeping API keys, credentials and certificates out of APISIX configuration by referencing HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager or environment variables, and the failure mode when a reference does not resolve.
Letting APISIX read upstream instances from Consul, Nacos, Eureka, DNS or Kubernetes instead of static node lists, and choosing a registry for VM, Kubernetes or mixed estates.
Scraping APISIX metrics with Prometheus: the default metrics endpoint and port, HTTP, upstream, stream and LLM metrics, label cardinality control, and alerting on gateway health.
Exporting APISIX request traces to an OpenTelemetry collector over OTLP HTTP, choosing a sampler, batch span settings, and the overhead of tracing at the gateway.
Streaming gateway access logs into Kafka with the kafka-logger plugin: batching defaults, TLS and SASL to the brokers, body logging limits and custom log formats for downstream SIEM or analytics.
Pushing APISIX request logs to Loki with the loki-logger plugin, setting the tenant for multi-tenant Loki, batching behavior and log format choices for querying gateway traffic.
Writing APISIX request logs straight into a ClickHouse table with the clickhouse-logger plugin for high-volume API analytics: required endpoint, database and table settings, batching and retries.
Protecting APIs behind APISIX with Okta as the OpenID Connect provider: bearer token validation by introspection or JWKS, required scopes and audience checks, browser login for internal apps, and the 3.16 to 3.19 hardening changes.
Using Microsoft Entra ID tokens to secure APIs at the APISIX gateway: app registrations for APIs and clients, issuer and audience validation, scope checks, local JWKS verification for throughput and client credentials for services.
Shipping APISIX request logs to Elasticsearch with the elasticsearch-logger plugin: daily indices, credentials encrypted in etcd, batching and backlog limits, TLS verification and what to log without leaking tokens.
Metering API calls per customer and billing them with self-hosted Lago: the lago plugin event fields, mapping consumers to Lago subscriptions, batching to the Lago API, and why dropped batches need a second log stream.
Routing API traffic through APISIX to AWS Lambda: function URLs or API Gateway endpoints, IAM SigV4 signing versus API keys, path forwarding, timeouts and when the gateway should sit in front of serverless functions at all.
Choosing a tracing plugin for APISIX when OpenTelemetry is not the standard: the zipkin and skywalking tracers, sampling, propagating trace headers to upstreams and linking gateway spans to service traces.
Sending APISIX gateway data to commercial observability tools: the splunk-hec-logging logger, datadog metrics, batching and backlog limits from 3.18, sensitive fields in logs and controlling ingest cost.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.