Skip to main content
API7.ai Logo
Version: 3.9.x

Secret Providers

As a critical infrastructure component, API gateways interact with various upstream services and handle API traffic, which may involve sensitive data such as passwords, tokens, and SSL certificates. This sensitive information must be properly stored, encrypted, rotated, and retired to ensure system security.

Users can store secrets directly in API7 Gateway, where selected sensitive fields are encrypted before database storage. Do not rely on this encryption to protect credentials if the database or a backup is compromised. If sensitive values and their encryption keys must remain outside the Control Plane, store those values in a third-party secrets manager. API7 Gateway can reference secrets stored in HashiCorp Vault or AWS Secrets Manager through variables.

info

Starting from version 3.9.11, secret references ($secret://, $env://) are resolved centrally and work with any plugin configuration field automatically. In versions prior to 3.9.11, only a limited set of plugin fields had explicit secret reference support (e.g., redis_password in Limit Count, client_id/client_secret in Authz-Casdoor, appid in Wolf RBAC, user_dn in LDAP Authentication).

Why Use Secret Providers​

API7 Gateway employs Secret Providers to decouple secret storage and management from API gateways, thus enhancing overall security. Secret providers integrate with HashiCorp Vault, AWS Secrets Manager, and Kubernetes Secrets. A secret provider object contains connection and authentication information for a specific secret manager:

Screenshot of the Secret Provider configuration form in the API7 Gateway Dashboard, where the user selects the secrets manager type (HashiCorp Vault or AWS Secrets Manager) and supplies the connection and authentication details

Users can store secrets such as credentials used for consumer authentication or SSL certificates used during HTTPS requests in the secret manager. These secrets are then integrated and referenced in API7 Gateway via secret providers. This setup allows API7 Gateway to securely reference the corresponding secrets, such as the key needed to authenticate a consumer.

Screenshot showing a plugin field in API7 Gateway being set to a secret reference (for example $secret://aws/my-secret/key) that resolves against a configured AWS Secrets Manager provider at runtime

The diagram below illustrates the consumer authentication flow, where secrets are stored in the secret provider, and API7 Gateway retrieves secrets from the secret providers after connecting and authenticating with them. This process decouples the secrets from the API gateway.

Diagram of the consumer authentication flow with an external secret provider: the API client sends a credential in the request to API7 Gateway, which during authentication resolves the configured secret reference by calling the secrets manager (HashiCorp Vault or AWS Secrets Manager) and compares the retrieved value, rather than reading a secret stored inside the gateway

Key Features​

  • Store sensitive information using third-party secret providers, decoupling secrets from API gateways and enhancing security.
  • Reference externally stored secrets as variables, simplifying configuration management.
  • Support multiple secret providers to accommodate complex enterprise architectures and unify secret management.
  • Precisely control access to sensitive information, preventing unauthorized usage and data breaches.

Use Cases​

Enhanced Data Security​

Managing large volumes of sensitive information is a significant challenge for many enterprises. API7 Gateway offers a secure solution by integrating with secret providers such as HashiCorp Vault, AWS Secrets Manager, and Kubernetes Secrets. Enterprises can store sensitive data on these platforms and reference them as variables within API7 Gateway, decoupling API gateway and secret management. This prevents sensitive information from being exposed in system configurations, greatly enhancing data security. Additionally, centralizing sensitive data and keys on a dedicated management platform improves efficiency, enables audit tracking, and allows flexible access control. This helps enterprises effectively address complex security challenges.

Rotate Referenced Secrets​

API7 Gateway resolves secret references at runtime, but secret values and derived consumer credentials are cached. Plugin configurations can pick up a changed backend value after the raw secret cache refreshes. Consumer credentials can keep the old value until the consumer or secret-provider configuration changes, or the gateway restarts. Plan an overlap period for credential rotation and verify the replacement and retired values through every gateway instance.

Audit and Compliance​

Using keys and sensitive information typically needs to comply with industry standards and regulatory requirements. After integrating with third-party secrets managers, API7 Gateway can record detailed access logs and audit information for secret provider resources, such as creating, editing, or deleting secret providers. This helps enterprises with compliance checks and security analysis. Through audit tracking, businesses can promptly detect abnormal access behavior and take appropriate protective measures.

The reference relationships for variables in consumer credentials can be viewed in the reference list of the secret provider on the API7 dashboard. When editing or deleting a secret provider, reference checks are performed to prevent configuration errors due to invalid variable references.