Kong: 8000 is the proxy port, 8001 is the Admin API

Traffic goes to 8000/8443; configuration goes to 8001. Exposing 8001 to the internet hands anyone full control of the gateway, so it must never be published.

Code

# 8000  proxy       (HTTP)
# 8443  proxy       (HTTPS)
# 8001  Admin API   (HTTP)   <- bind to localhost only
# 8002  Kong Manager GUI
# 8100  status/health

# kong.conf
admin_listen = 127.0.0.1:8001
proxy_listen = 0.0.0.0:8000, 0.0.0.0:8443 ssl
status_listen = 0.0.0.0:8100

Output

# The default in many quickstarts is admin_listen = 0.0.0.0:8001, which is
# fine on a laptop and a full compromise in production:
#
#   curl -X DELETE http://your-gateway:8001/services/billing
#
# There is no authentication on the Admin API in open-source Kong. Bind it
# to localhost, or put it behind a network policy.

Run this yourself in the Online Java Compiler, spin up a live REST API in the API Sandbox, or practise with Java interview questions.

Published 2026-08-25