API7 Docs
Get Started

Tutorial: Proxying and Managing API Requests via Plugins

A hands-on tutorial that walks you through proxying API requests, adding authentication with Key Auth, and enabling rate limiting with the Limit Count plugin.

This tutorial builds on the Quick Start and walks you through a realistic scenario: proxying API requests through API7 Gateway while applying authentication and rate limiting using plugins.

What you will learn:

  1. Create a service and route for a backend API
  2. Add the key-auth plugin to require API key authentication
  3. Create a consumer with credentials
  4. Add the limit-count plugin to enforce rate limits
  5. Test the complete setup

Time to complete: ~15 minutes

Prerequisites: A running API7 Gateway instance. If you have not set one up yet, complete the Quick Start first. If you want to follow the Admin API examples, obtain a token from the Dashboard before you begin.

Step 1: Create a Service and Route

Create a service that proxies to the httpbin.org service:

  1. In the Dashboard sidebar, navigate to the default gateway group and click Services.
  2. Click Add Service, then Add Manually.
  3. Configure the service:
FieldValue
Namedemo-api
Service TypeHTTP (Layer 7 Proxy)
Upstream SchemeHTTP
How to find the upstreamUse Nodes
  1. Click Add Node and configure:
FieldValue
Hosthttpbin.org
Port80
Weight100
  1. Click Add to create the service.
  2. Click the demo-api service, then click Add Route.
  3. Configure the route:
FieldValue
Nameget-request
Path/get
MethodsGET
  1. Click Add.

Step 2: Verify the Proxy

Test the route to validate the basic setup before adding plugins:

curl -i "http://localhost:9080/get"

You should receive a 200 OK response with the HTTPBin response body, confirming the proxy works.

Step 3: Enable Key Auth Plugin

The key-auth plugin requires consumers to provide a valid API key.

  1. In the default gateway group, navigate to Services and click the demo-api service.
  2. Click Plugins, then Enable Plugin.
  3. Search for key-auth and enable it.
  4. Use the default configuration and click Submit.

Test Without a Key

curl -i "http://localhost:9080/get"

Expected response:

HTTP/1.1 401 Unauthorized
{"message":"Missing API key in request"}

Step 4: Create a Consumer

Create a consumer with an API key credential:

  1. In the Dashboard sidebar, navigate to Consumers, then click Create Consumer.
  2. Configure the consumer:
FieldValue
Nametest-consumer
  1. Click Submit to create the consumer.
  2. Click the test-consumer consumer to open it, then select the Credentials tab.
  3. Click Create Credential and select key-auth as the type.
  4. Configure the credential:
FieldValue
Nametest-consumer-key
Keymy-secret-api-key
  1. Click Submit.

Test With the API Key

curl -i "http://localhost:9080/get" -H "apikey: my-secret-api-key"

Expected response: 200 OK.

Step 5: Enable Rate Limiting

Add the limit-count plugin to restrict the number of requests a consumer can make.

  1. In the default gateway group, navigate to Services and click the demo-api service.
  2. Click Plugins, then Enable Plugin.
  3. Search for limit-count and configure it:
{
  "count": 5,
  "time_window": 60,
  "rejected_code": 429,
  "key_type": "var",
  "key": "consumer_name",
  "policy": "local"
}
  1. Click Submit.

Test the Rate Limit

Send multiple requests in quick succession:

for i in $(seq 1 6); do
  echo "Request $i:"
  curl -s -o /dev/null -w "HTTP %{http_code}\n" \
    http://localhost:9080/get -H "apikey: my-secret-api-key"
done

Expected output:

Request 1: HTTP 200
Request 2: HTTP 200
Request 3: HTTP 200
Request 4: HTTP 200
Request 5: HTTP 200
Request 6: HTTP 429

Next Steps

Management Options

Previous Page

Learn More About API7 Products and APISIX

Next Page