Key Authentication - Encrypted: Disable a key location - Plugin

Disable a key locationv1.0+

This example disables using a key in a query parameter for the Key Auth Encrypted plugin.

Prerequisites

Before configuring this plugin, you must enable Kong Gateway’s encryption Keyring.

Set up the plugin

Add this section to your kong.yaml configuration file:

_format_version: "3.0"
plugins:
  - name: key-auth-enc
    config:
      key_names:
      - apikey
      key_in_query: false

Make the following request:

curl -i -X POST http://localhost:8001/plugins/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "key-auth-enc",
      "config": {
        "key_names": [
          "apikey"
        ],
        "key_in_query": false
      }
    }
    '

Make the following request:

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/plugins/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "key-auth-enc",
      "config": {
        "key_names": [
          "apikey"
        ],
        "key_in_query": false
      }
    }
    '

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
controlPlaneId: The id of the control plane.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.

See the Konnect API reference to learn about region-specific URLs and personal access tokens.

echo "
apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
  name: key-auth-enc
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
  labels:
    global: 'true'
config:
  key_names:
  - apikey
  key_in_query: false
plugin: key-auth-enc
" | kubectl apply -f -

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Add the following to your Terraform configuration to create a Konnect Gateway Plugin:

resource "konnect_gateway_plugin_key_auth_enc" "my_key_auth_enc" {
  enabled = true

  config = {
    key_names = ["apikey"]
    key_in_query = false
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
}

Add this section to your kong.yaml configuration file:

_format_version: "3.0"
plugins:
  - name: key-auth-enc
    service: serviceName|Id
    config:
      key_names:
      - apikey
      key_in_query: false

Make sure to replace the following placeholders with your own values:

serviceName|Id: The id or name of the service the plugin configuration will target.

Make the following request:

curl -i -X POST http://localhost:8001/services/{serviceName|Id}/plugins/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "key-auth-enc",
      "config": {
        "key_names": [
          "apikey"
        ],
        "key_in_query": false
      }
    }
    '

Make sure to replace the following placeholders with your own values:

serviceName|Id: The id or name of the service the plugin configuration will target.

Make the following request:

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/services/{serviceId}/plugins/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "key-auth-enc",
      "config": {
        "key_names": [
          "apikey"
        ],
        "key_in_query": false
      }
    }
    '

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
controlPlaneId: The id of the control plane.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
serviceId: The id of the service the plugin configuration will target.

See the Konnect API reference to learn about region-specific URLs and personal access tokens.

echo "
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: key-auth-enc
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
config:
  key_names:
  - apikey
  key_in_query: false
plugin: key-auth-enc
" | kubectl apply -f -

Next, apply the KongPlugin resource by annotating the service resource:

kubectl annotate -n kong service SERVICE_NAME konghq.com/plugins=key-auth-enc

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Add the following to your Terraform configuration to create a Konnect Gateway Plugin:

resource "konnect_gateway_plugin_key_auth_enc" "my_key_auth_enc" {
  enabled = true

  config = {
    key_names = ["apikey"]
    key_in_query = false
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
  service = {
    id = konnect_gateway_service.my_service.id
  }
}

Add this section to your kong.yaml configuration file:

_format_version: "3.0"
plugins:
  - name: key-auth-enc
    route: routeName|Id
    config:
      key_names:
      - apikey
      key_in_query: false

Make sure to replace the following placeholders with your own values:

routeName|Id: The id or name of the route the plugin configuration will target.

Make the following request:

curl -i -X POST http://localhost:8001/routes/{routeName|Id}/plugins/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "key-auth-enc",
      "config": {
        "key_names": [
          "apikey"
        ],
        "key_in_query": false
      }
    }
    '

Make sure to replace the following placeholders with your own values:

routeName|Id: The id or name of the route the plugin configuration will target.

Make the following request:

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/routes/{routeId}/plugins/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "key-auth-enc",
      "config": {
        "key_names": [
          "apikey"
        ],
        "key_in_query": false
      }
    }
    '

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
controlPlaneId: The id of the control plane.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
routeId: The id of the route the plugin configuration will target.

See the Konnect API reference to learn about region-specific URLs and personal access tokens.

echo "
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: key-auth-enc
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
config:
  key_names:
  - apikey
  key_in_query: false
plugin: key-auth-enc
" | kubectl apply -f -

Next, apply the KongPlugin resource by annotating the httproute or ingress resource:

kubectl annotate -n kong httproute  konghq.com/plugins=key-auth-enc

kubectl annotate -n kong ingress  konghq.com/plugins=key-auth-enc

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Add the following to your Terraform configuration to create a Konnect Gateway Plugin:

resource "konnect_gateway_plugin_key_auth_enc" "my_key_auth_enc" {
  enabled = true

  config = {
    key_names = ["apikey"]
    key_in_query = false
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
  route = {
    id = konnect_gateway_route.my_route.id
  }
}

Key Authentication - Encrypted

Disable a key locationv1.0+

Prerequisites

Set up the plugin

Help us make these docs great!

Still need help