Consumers and API keys

Kong Course · lesson 6 of 15 · 5 min read

Who is calling matters - here you can watch a request pass and fail on the key alone.

Open this lesson in the learning hub

Key points

  • A Consumer is an identity Kong knows about: an app, a partner, an internal team.
  • Credentials attach to a consumer, so a key identifies who, not just whether they may pass.
  • Once Kong knows the consumer it can apply per-consumer limits and add identity headers upstream.
  • Your service can then trust X-Consumer-Id instead of parsing tokens itself.
  • Revoking access is deleting one credential - no redeploy of anything.

Example

consumers:
  - username: mobile-app
    keyauth_credentials:
      - key: MOBILE-KEY-123

  - username: partner-acme
    keyauth_credentials:
      - key: ACME-KEY-999

A credential identifies a consumer, which is what makes per-caller policy and instant revocation possible.

The request lifecycle Rate limiting you can trip yourself

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the Kong Course course, and every lesson in it is listed on the Kong Course contents page.