Plugins
A Plugin is a modular component that intercepts and modifies the request and response flow through the gateway. API7 Gateway includes over 100 enterprise-grade plugins for authentication, traffic control, observability, security, and AI capabilities.
Plugin execution
Plugins are executed in a specific order based on their Priority. A plugin with a higher priority number runs before a plugin with a lower priority number. This ensures that essential functions like authentication are completed before traffic control or proxying.
Plugin scopes
You can apply plugins at different levels of the configuration hierarchy:
- Route level: Applied to a specific route. Only affects traffic matching that route.
- Service level: Applied to a Service Template. Affects all routes within that service.
- Consumer level: Applied to a specific Consumer. Affects all traffic identified as belonging to that consumer.
- Global Rule: Applied to an entire Gateway Group. Affects all routes managed by that group.
Plugin categories
API7 Gateway categorizes plugins by their primary function. The following table provides examples of commonly used enterprise plugins:
| Category | Examples |
|---|---|
| Authentication | key-auth, jwt-auth, basic-auth, hmac-auth, openid-connect, ldap-auth, multi-auth |
| Traffic Control | limit-count, limit-req, limit-conn, limit-count-advanced, api-breaker, traffic-split |
| Transformation | proxy-rewrite, response-rewrite, body-transformer, grpc-transcode |
| Observability | prometheus, opentelemetry, http-logger, kafka-logger, loki-logger, splunk-hec-logging |
| Security | cors, ip-restriction, ua-restriction, consumer-restriction, csrf, data-mask, opa, chaitin-waf |
| AI Gateway | ai-proxy, ai-proxy-multi, ai-rate-limiting, ai-rag, ai-prompt-template, ai-prompt-guard |
| Serverless | aws-lambda, azure-functions, serverless-pre-function, serverless-post-function |
Plugin Metadata
Some plugins require shared configuration across all instances of that plugin type. This is managed via Plugin Metadata. For example, you can define a shared Kafka broker address in the kafka-logger metadata, which all instances of the plugin will then use.
Next steps
- Configure Rate Limiting — protect your services from traffic spikes.
- Develop Custom Lua Plugins — extend the gateway with your own logic.
- Services and Routes — learn how plugins attach to services and routes.