Choosing an auth plugin

Kong Course · lesson 8 of 15 · 4 min read

Four options, and a decision tree that gets you to the right one in three clicks.

Open this lesson in the learning hub

Key points

  • key-auth is a shared secret in a header - simple, fine for internal and server-to-server calls.
  • basic-auth is username and password; easy, but weak unless everything is TLS.
  • jwt verifies a signed token, so Kong can check identity without calling your auth server.
  • oauth2 / OIDC delegates to an identity provider - the right answer for third-party or user login.
  • Whichever you pick, it runs in access, so an unauthenticated request never reaches upstream.

Pick auth by who is calling and whether a user must consent - that single question decides it.

Rate limiting you can trip yourself Upstreams, targets and health

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the Kong Course course, and every lesson in it is listed on the Kong Course contents page.