Plugins: behaviour without code

Key points

• A plugin is a unit of behaviour - auth, rate limiting, logging - that Kong runs around your request.
• Scope decides who it applies to: global, or bound to a service, a route, or a consumer.
• Narrower scope wins, so a route-level config overrides the same plugin set globally.
• This is the payoff of a gateway: adding auth is config, not a code change in ten services.
• Plugins run in a fixed order set by each plugin's priority - not the order you added them.

Example

plugins:
  - name: rate-limiting          # global: applies to everything
    config: { minute: 100, policy: local }

  - name: key-auth               # narrower: only this route
    route: orders-api
    config: { key_names: [ apikey ] }

Plugins turn cross-cutting behaviour into configuration, and the narrowest scope wins.