Credentials
Understand the concept of credentials in Apache APISIX, which manage authentication configurations for consumers to enhance security and access control.
Overview
In APISIX, a credential object is an entity used to store authentication configurations associated with consumers. A consumer can be associated with one or more credentials from a designated list of authentication plugins, including key-auth (opens in Plugin Hub docs), basic-auth (opens in Plugin Hub docs), jwt-auth (opens in Plugin Hub docs), and hmac-auth (opens in Plugin Hub docs). The decoupling of credentials facilitates credential reuse and rotation as well as enhanced security. You will not see the credential details when examining consumers.
The following diagram illustrates an example of credentials using two routes, each with one type of authentication enabled, and one consumer, whose authentication details are configured in credentials. Only requests with the valid credentials will be authenticated and allowed to access the upstream resource:
Note that when a consumer is successfully authenticated, APISIX adds additional headers, such as consumer username and identifier, to the request before proxying it to the upstream service. The upstream service will be able to differentiate between consumers and implement additional logic as needed.
Related
Tasks that use this concept
Related concepts
- Key Concepts - Consumers
- Admin API - Credentials