Kong: a Consumer is who is calling, not a user of your app

Consumers are gateway-level identities - a partner, a mobile app, an internal service. They exist so credentials, quotas and ACLs can be attached to a caller.

Code

curl -X POST http://localhost:8001/consumers \
  --data username=mobile-app \
  --data custom_id=team-payments

# credentials of several kinds can hang off one consumer
curl -X POST http://localhost:8001/consumers/mobile-app/key-auth --data key=k1
curl -X POST http://localhost:8001/consumers/mobile-app/jwt      --data key=iss1

# and per-consumer configuration
curl -X POST http://localhost:8001/consumers/mobile-app/plugins \
  --data name=rate-limiting --data config.minute=5000

Output

# custom_id is the link back to your own system's identifier - use it rather
# than encoding meaning into username.
#
# A consumer with no credential can still be useful as the `anonymous`
# fallback target of an auth plugin, which is how a public tier gets its own
# rate limit instead of no limit.

Run this yourself in the Online Java Compiler, spin up a live REST API in the API Sandbox, or practise with Java interview questions.

Published 2026-08-25