We're excited to announce the expansion of Kong Identity to include centralized principals, which is a single source of truth for every entity (machine, agent, processes, etc) that needs to be authenticated across API gateways, event gateways, and developer portal applications. For platform teams managing distributed API estates, this means one unified identity regardless of which gateway, protocol, or consumer population is involved.
Modern enterprise APIs don't live in one place. They're spread across multiple gateways, deployed across regions and clouds, and accessed by a growing mix of consumers, internal developers, external partners, machine-to-machine services, and increasingly, AI agents acting autonomously on behalf of users and systems.
Each of those populations has different authentication needs, different access patterns, and different risk profiles. Managing them coherently across a distributed estate can be challenging.
Approaches that may work initially — API credentials in one system, Kafka authentication in another, developer portal access in a third — create silos of identity and access that grow harder to govern as the estate scales. Each identity silo has its own lifecycle management, its own audit trail, and its own blast radius when something goes wrong. Static credentials get distributed to hundreds of workloads. Rotation gets deferred.
Add AI agents to that picture and the problem sharpens. Agents that consume event streams, call APIs, and trigger downstream actions need to be authenticated, authorized, and auditable — the same as any other principal, but at a scale and velocity that manual credential management can't keep up with. An Agent provisioned without a managed identity record is a credential no one is watching.
The principals directory is a single, centralized store that manages machine principals across your entire connectivity infrastructure. One record. One lifecycle. One place to rotate, audit, and govern.
Each principal is a first-class entity: it can hold multiple identity types — Okta, Cognito, custom registry identifiers — alongside structured metadata that flows into OAuth claims, policy expressions, and access control decisions at runtime.
The principals directory deeply integrates Kong Identity with API and Event Gateways by providing a unified identity layer that works across the Kong-managed estate. Here's what you get:
Event streaming platforms like Kafka were built to move data fast. Their native authentication mechanisms were designed to secure broker-to-broker communication — not the multitude of consumers and applications now connecting to them from outside the cluster. The result is a common workaround: static credentials distributed to every client, with limited ability to rotate them, audit them, or enforce granular access based on who the caller actually is.
Kong Event Gateway already addresses part of this by acting as a security perimeter — terminating client connections at the edge, enforcing policy, and shielding brokers from direct exposure. The Kong Identity principals directory extends this by providing a persistent identity record that travels with every request. When a client connects, Kong Event Gateway can look up that principal, pull in structured metadata, like team ownership, environment, agent type, and custom identifiers, to make that context available to policy expressions in real time.
The practical effect: access control for event traffic can evolve from coarse credential checks to identity-aware policy. An AI agent consuming a sensitive topic can be authenticated, enriched with metadata about its role and ownership, and evaluated against fine-grained ACLs (access control lists) — all before reaching the broker.
Take an inventory modeling agent that needs to read from Kafka topic and call two internal APIs. The agent is provisioned as a principal with a unique identity type, tagged with metadata (owning team, environment, agent purpose). When connecting to the Kong Event Gateway, that meta-data is part of the authentication policy decision that this agent gets to read the forecasting topic in production and nothing else. Rotating credentials next quarter is one directory operation, not a separate set of support tickets with one to rotate Kafka ACLs and the other to rotate Gateway API keys. If the Agent's behavior ever looks wrong, every action it took is in the same audit trail and there is a single point to shut it down.
For organizations running event-driven architectures at scale, the principals directory closes the gap between the security model applied to API traffic and the one applied to event traffic — making both consistently governed by the same identity layer.
Identity has always been a critical part of security infrastructure. What's changed is that the infrastructure now spans APIs, events, and developer-facing surfaces simultaneously — and those surfaces need a common identity model to govern them consistently.
Kong Identity's principals directory is that model. One entitlement layer across API Gateway, Event Gateway, and Developer Portal Applications, with the same control plane, the same audit trail, and the same rotation workflows.
The Kong Identity principals directory is now GA.** **Visit the [_docs_](https://developer.konghq.com/identity/principals/)_docs_ or contact your account team to learn more. Or [_get a demo_](https://konghq.com/contact-sales)_get a demo_ to see Kong Identity in action.
kongctl was built with the modern development stack in mind. Developers working in a terminal want the ability to query systems quickly to verify state, behaviors, and capabilities. Coding harnesses need well defined tools and accurate schemas for
The widespread adoption of Kafka and event streaming platforms is evident across several enterprises, where they serve as the backbone of critical operations, ranging from financial transactions to AI inference pipelines. However, in the domains of
The Langflow CVEs and Dify Vulnerabilities: What Actually Happened Langflow's security problems arrived in waves. CVE-2025-3248 introduced a code injection vulnerability allowing remote code execution through unsanitized user input \10\]. Months la
Quality is at the core of every product we build. To move fast without compromising on quality, we rely on an extensive set of test suites that tell us quickly whether a change has caused a regression. Those suites are large enough that a single ful
The Stainless deal tells you where the easy wins are headed. Turning an OpenAPI spec into a TypeScript SDK, a Python client, and an MCP server is going to be a button. That's good. It lowers the activation energy for getting an agent to call your
Kong customers include some of the most forward-thinking, tech-savvy organizations in the world. And while we’re proud to help them innovate through traditional APIs, the reality is that their ambitions don’t stop there. Increasingly, our customers a
