The latest news and announcements about Kong, our products, and our ecosystem, as well as voices from across our community.
Bots make up more than a third of internet traffic, and API endpoints attract more of it than web pages do. Scanners hunting for .env files, credential-stuffing scripts, LLM training crawlers, and the long tail of low-effort probes all hit your gateway before they ever reach a service. Every one of…
As of October 2026, Kong Gateway Enterprise 3.12 will enter its End Of Life (EOL) phase and will no longer be fully supported by Kong. Following this, Kong Gateway Enterprise 3.12 will enter a 12-month sunset support period, focused on helping customers upgrade to a current version of Kong Gateway…
Standing up a production agent means taking it through six stages: At API & AI Summit, we announced the evolution of Kong Konnect into the AI Connectivity Platform and announced a slate of launches built around that idea. Here's what we launched, where each piece fits, and what you can use today.…
Kong Webhook Engine turns business events into triggers for applications and AI agents — connecting what happens in the business to what happens next. Most AI agent interactions today start with an explicit request. A user sends a prompt. An application invokes an agent. A workflow calls one. The…
Two kinds of problems only show up once an API is already live. Something breaks, and a team needs visibility into one specific node right now — not after a redeploy. Or the right behavior for a request depends on who's calling it: a consumer's plan, a token claim, metered usage, or boolean feature…
Regulated industries don't get to choose their cryptography standards; governments and auditors choose for them. If you sell software to a U.S. federal agency, a bank, a healthcare payer, or almost any organization operating under FedRAMP, HIPAA, or PCI DSS oversight, the cryptographic modules in…
As of Aug 31 2026, Kong Gateway Enterprise 3.4 will enter its End of Life (EOL) phase and will no longer be fully supported by Kong. Following this, Kong Gateway Enterprise 3.4 will enter a 12-month sunset support period, focused on helping customers upgrade to a current version of Kong Gateway…
As API ecosystems grow, developers and platform teams often work in separate environments. Platform teams manage APIs, gateways, and governance centrally, while developers recreate those configurations locally for testing and debugging. Over time, this can lead to configuration drift, inconsistent…
Each change to Kong Gateway's codebase triggers a comprehensive test suite that runs more than 17,000 * 2 = 34,000 test cases among the two primary architectures (x86 and ARM) we support. This process takes about 23.5 hours on a single machine. But we don't wait that long. A large fleet of machines…
Legacy API management platforms were built for a different era. They weren't designed for microservices, multi-cloud deployments, or AI workloads. They're expensive, rigid, and hold engineering teams back. The problem is that migration has always felt hard. APIs are load-bearing infrastructure.…
Digital agreements are at the heart of many critical business processes. As companies modernize their technology stacks and adopt API-driven architectures, integrating agreement workflows directly into applications has become increasingly important. By combining the capabilities of Kong Konnect…
The best platform teams don't write glue code — they configure great infrastructure. But as API platform architectures get more complex, policy logic does not always fit into a one-size-fits-all model. Not only that, but security toil compounds with every new service, credential, and cloud provider…
Modern API architectures are no longer linear. A single request can traverse multiple layers of authentication, transformation, enrichment, and observability. As these flows grow more dynamic, the need for fine-grained control over when plugins execute becomes critical. For years, the standard…
OAuth 2.0 Token Exchange fundamentally alters how services establish trust. And the API gateway is the ideal location to enforce this new model. Modern applications don’t run as a single monolithic. They are composed of services — frontend APIs, backend microservices, third-party integrations —…
Enterprise security teams have clear requirements: no static credentials, no exceptions. Every service-to-service connection, whether it's Kong talking to databases, caches, or vaults, should authenticate using the same IAM-based identity model that governs the rest of their cloud infrastructure.…
AI APIs don't get enough credit for how much weight they're actually carrying. These AI APIs aren't merely technical connectors. They're, in fact, cost drivers and potential revenue engines. And when something goes sideways, they're ground zero. In production, they behave nothing like the…