Authentication — Complete Gateway Auth Integration Guide

In this tutorial, you will learn about Authentication. We cover key concepts, practical examples, and best practices to help you master this topic.

Authentication at the gateway validates client identity at the entry point. The gateway verifies tokens, API keys, or other credentials before forwarding requests to backend services.

What You'll Learn

You'll learn how to configure authentication in popular gateways and how gateway auth differs from service-level auth.

Why It Matters

Centralizing authentication at the gateway ensures every request is authenticated consistently. Backend services can trust that the gateway has already verified the caller's identity.

Real-World Use

AWS API Gateway uses a Lambda authorizer to validate JWT tokens. The authorizer caches the validation result for 5 minutes. Backend services receive the validated user context in the request header.

Implementation

# Kong JWT authentication
plugins:
  - name: jwt
    config:
      uri_param_names:
        - jwt
      claims_to_verify:
        - exp
        - nbf
      key_claim_name: iss
      secret_is_base64: false
      anonymous: null
      run_on_preflight: true

consumers:
  - username: mobile-app
    jwt_secrets:
      - key: https://auth.example.com
        secret: "your-256-bit-secret"
        algorithm: HS256

# AWS API Gateway Lambda authorizer
import jwt

def lambda_handler(event, context):
    token = event["authorizationToken"]
    try:
        payload = jwt.decode(token, "public-key", algorithms=["RS256"])
        effect = "Allow"
        context = {"userId": payload["sub"], "role": payload.get("role", "")}
    except Exception:
        effect = "Deny"
        context = {}
    return generate_policy(token, effect, event["methodArn"], context)

Common Mistakes

| Mistake | Fix | |---------|-----| | Not Caching auth decisions | Each request re-validates; causes latency | Cache auth results with TTL | | Passing raw tokens to backend | Backend re-validates unnecessarily | Pass decoded user context as header | | Gateway auth but no service auth | Internal traffic bypasses gateway | Backend services must still verify internal traffic | | One auth method for all endpoints | Some endpoints need different auth | Support multiple auth methods per route | | No anonymous access for public endpoints | Health checks and public pages blocked | Allow anonymous access where appropriate |

What's Next

Learn about SSL termination at the API gateway.