The request lifecycle

Kong Course · lesson 5 of 15 · 4 min read

The phases a request passes through, and why the order explains most surprises.

Open this lesson in the learning hub

Key points

  • A request moves through phases: rewrite, access, balancer, then response and log.
  • Auth plugins run in access, which is before the balancer - that is why a 401 never reaches upstream.
  • Response-shaping plugins run on the way back, so they see the upstream status.
  • log runs after the client already has its response, so logging cannot slow the caller down.
  • Within one phase, plugin priority decides order - auth deliberately outranks rate limiting.

Phase order is the mental model: access decides, balancer forwards, log happens after the client left.

Plugins: behaviour without code Consumers and API keys

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the Kong Course course, and every lesson in it is listed on the Kong Course contents page.