Secure your APIs with confidence. Explore methods, protocols, and best practices for implementing robust authentication—from OAuth and JWT to zero-trust architectures—across modern API ecosystem
We are truly excited to release Kong Mesh 1.2 today and introduce three new security capabilities that make it the most secure enterprise service mesh available today. Kong Mesh is built on open source Kuma which Kong created in 2019 and has since donated it to the CNCF . Kuma is a universal…
[](/blog/product-releases/kong-mesh-1-2)
In this tutorial, I'm going to walk through adding OAuth2 authorization and authentication to your service with the Kong API Gateway OAuth2 plugin . First, I'll cover the fundamentals. If you're already familiar with how Kong Gateway and OAuth2 work, skip ahead to the tutorial . Interconnected.…
[](/blog/engineering/kong-gateway-oauth2)
As you build and maintain more applications, your authentication strategy becomes increasingly important. It may also be top of mind for your boss since technology leaders cited "improve application security" as one of their top priorities in this year's Digital Innovation Benchmark . The Kong…
[](/blog/engineering/jwt-kong-gateway)
Kong Enterprise provides many out-of-the-box plugins to support various access control solutions like basic authentication , key authentication , JWT, LDAP, OAuth 2.0, OpenID Connect, among others. Most of the time, you should be able to find a plugin to suit your needs to protect your private or…
[](/blog/engineering/custom-authentication-and-authorization-framework-with-kong)
Today, we are excited to announce the release of Kong 1.3! Our engineering team and awesome community has contributed numerous features and improvements to this release. Based on the success of the 1.2 release, Kong 1.3 is the first version of Kong that natively supports gRPC proxying, upstream…
[](/blog/product-releases/kong-1-3-released)Secure your AI infrastructure with prompt guards, PII sanitization, and centralized governance. Control LLM costs with token-based rate limiting and semantic routing across providers.