The latest news and announcements about Kong, our products, and our ecosystem, as well as voices from across our community.
The best platform teams don't write glue code — they configure great infrastructure. But as API platform architectures get more complex, policy logic does not always fit into a one-size-fits-all model. Not only that, but security toil compounds with every new service, credential, and cloud provider…
[](/blog/product-releases/kong-gateway-3-14)
Modern API architectures are no longer linear. A single request can traverse multiple layers of authentication, transformation, enrichment, and observability. As these flows grow more dynamic, the need for fine-grained control over when plugins execute becomes critical. For years, the standard…
[](/blog/engineering/conditional-policy-execution)
OAuth 2.0 Token Exchange fundamentally alters how services establish trust. And the API gateway is the ideal location to enforce this new model. Modern applications don’t run as a single monolithic. They are composed of services — frontend APIs, backend microservices, third-party integrations —…
[](/blog/engineering/token-exchange-at-the-gateway)
Enterprise security teams have clear requirements: no static credentials, no exceptions. Every service-to-service connection, whether it's Kong talking to databases, caches, or vaults, should authenticate using the same IAM-based identity model that governs the rest of their cloud infrastructure.…
[](/blog/engineering/cloud-native-authentication)
As of January 2026, Kong Gateway Enterprise 3.9 will enter its End Of Life (EOL) phase and will no longer be fully supported by Kong. Following this, Kong Gateway Enterprise 3.9 will enter a 12-month sunset support period, focused on helping customers upgrade to a current version of Kong Gateway…
[](/blog/product-releases/kong-gateway-enterprise-3-9-eol)
Discover expanded OpenTelemetry support, full cloud-native authentication, powerful Datakit orchestrations, and PCI DSS 4.0 attestation for Kong Konnect and Cloud Gateways. As API ecosystems grow more complex, maintaining visibility and security shouldn't be a hurdle. Kong Gateway 3.13 simplifies…
[](/blog/product-releases/kong-gateway-3-13)
As of September 2025, Kong Gateway Enterprise 3.8 will enter its End Of Life (EOL) phase and will no longer be fully supported by Kong. Following this, Kong Gateway Enterprise 3.8 will enter a 12-month sunset support period, focused on helping customers upgrade to a current version of Kong Gateway…
[](/blog/product-releases/kong-gateway-enterprise-3-8-x-x-eol)
We’re excited to bring you Kong Gateway Enterprise 3.11 with compelling new features to make your APIs and event streams even more powerful, including: We’ll also touch on what’s new with Konnect networking and Active Tracing. There’s a lot to unpack, so keep on reading for the full story!…
[](/blog/product-releases/kong-gateway-enterprise-3-11)
I'm commonly asked by customers for advice on how they can build a good platform cross-charging model for their organization. And my gut reaction is nearly always "don't." We'll come back to why I think that later, but first let's look at what cross-charging means, why you might want it, and how it…
[](/blog/enterprise/platform-cross-charging-model)
Today, we're pleased to announce Kong Gateway 3.10, our next Long-Term Support (LTS) version. This LTS version will be supported until March 2028, up to three years from the release date. Please check our documentation here for more details on Kong’s support policy. Highlights of this release…
[](/blog/product-releases/kong-gateway-3-10)
Today we're excited to announce Kong Gateway 3.9! Since unveiling Kong Gateway 3.8 at API Summit 2024 just a few months ago, we’ve been busy making important updates and improvements to Kong Gateway. This release introduces new functionality around LLM support for AI governance and security and…
[](/blog/product-releases/kong-gateway-3-9)
APIs facilitate effortless communication and data exchange between applications and services. However, their inherent design, which codifies service capabilities within the API definition, makes them easily exploitable by malicious actors. API attacks in the US alone are projected to cost $506…
[](/blog/product-releases/content-inspection-injection-attack-protection)
In a previous blog post , we discussed the prevalence of bearer tokens (or access tokens) to restrict access to protected resources, the challenges the sheer nature of bearer tokens present, and available mitigations. To recap, presenting a bearer token is proof enough of an authorization grant to…
[](/blog/engineering/demonstrating-proof-of-possession-dpop-preventing-illegal-access-of-apis)
We're thrilled to announce the general availability of Kong Gateway 3.7 and Kong Gateway Enterprise 3.7. Along with enhancements and new features for both OSS and enterprise users, this version comes with the general availability of our edge AI Gateway. This release offers a brand new context…
[](/blog/product-releases/kong-gateway-3-7)
We're delighted to announce the release of Kong Gateway 3.4 for Kong Enterprise and Kong Konnect , featuring significant enhancements, such as secrets rotation support in secrets management, expanded plugin support in consumer groups, and more. The highlight of this update is the designation of…
[](/blog/product-releases/gateway-3-4-enterprise-and-konnect)
In the digital age, a top-notch API gateway must not only be reliable and secure but also bring robust governance and security features designed for enterprise needs. The new Kong Gateway 3.3 for Open Source comes with robust enhancements such as configurable queuing behavior, high-scale…
[](/blog/product-releases/kong-enterprise-3-3)