# Plugins

A **Plugin** is a modular component that intercepts and modifies the request and response flow through the gateway. API7 Gateway includes over 100 enterprise-grade plugins for authentication, traffic control, observability, security, and AI capabilities.

## Plugin execution[​](#plugin-execution "Direct link to Plugin execution")

Plugins are executed in a specific order based on their **Priority**. A plugin with a higher priority number runs before a plugin with a lower priority number. This ensures that essential functions like authentication are completed before traffic control or proxying.

## Plugin scopes[​](#plugin-scopes "Direct link to Plugin scopes")

You can apply plugins at different levels of the configuration hierarchy:

* **Route level**: Applied to a specific route. Only affects traffic matching that route.
* **Service level**: Applied to a Service. Affects all routes within that service.
* **Consumer level**: Applied to a specific Consumer. Affects all traffic identified as belonging to that consumer.
* **Global Rule**: Applied to an entire Gateway Group. Affects all routes managed by that group.

## Plugin categories[​](#plugin-categories "Direct link to Plugin categories")

API7 Gateway categorizes plugins by their primary function. The following table provides examples of commonly used enterprise plugins:

| Category            | Examples                                                                                                      |
| ------------------- | ------------------------------------------------------------------------------------------------------------- |
| **Authentication**  | `key-auth`, `jwt-auth`, `basic-auth`, `hmac-auth`, `openid-connect`, `ldap-auth`, `multi-auth`                |
| **Traffic Control** | `limit-count`, `limit-req`, `limit-conn`, `limit-count-advanced`, `api-breaker`, `traffic-split`              |
| **Transformation**  | `proxy-rewrite`, `response-rewrite`, `body-transformer`, `grpc-transcode`                                     |
| **Observability**   | `prometheus`, `opentelemetry`, `http-logger`, `kafka-logger`, `loki-logger`, `splunk-hec-logging`             |
| **Security**        | `cors`, `ip-restriction`, `ua-restriction`, `consumer-restriction`, `csrf`, `data-mask`, `opa`, `chaitin-waf` |
| **AI Gateway**      | `ai-proxy`, `ai-proxy-multi`, `ai-rate-limiting`, `ai-rag`, `ai-prompt-template`, `ai-prompt-guard`           |
| **Serverless**      | `aws-lambda`, `azure-functions`, `serverless-pre-function`, `serverless-post-function`                        |

## Plugin Metadata[​](#plugin-metadata "Direct link to Plugin Metadata")

Some plugins require shared configuration across all instances of that plugin type. This is managed via **Plugin Metadata**. For example, you can define a shared Kafka broker address in the `kafka-logger` metadata, which all instances of the plugin will then use.

## Next steps[​](#next-steps "Direct link to Next steps")

* [Configure Rate Limiting](https://docs.api7.ai/api7-gateway/how-to-guides/traffic-management/rate-limiting.md) — protect your services from traffic spikes.
* [Develop Custom Lua Plugins](https://docs.api7.ai/api7-gateway/how-to-guides/plugin-development/custom-lua-plugins.md) — extend the gateway with your own logic.
* [Services and Routes](https://docs.api7.ai/api7-gateway/key-concepts/services-and-routes.md) — learn how plugins attach to services and routes.