Credentials

In this document, you will learn the basic concept of credentials in APISIX, and how it works with consumers for a number of authentication plugins.

Explore additional resources at the end of the document for more information on related topics.

Overview

In APISIX, a credential object stores authentication plugin configuration associated with a consumer. Each credential contains at most one enabled authentication plugin, such as key-auth, basic-auth, jwt-auth, or hmac-auth.

A consumer can have credentials for different authentication plugins. It can also have multiple credentials for the same authentication plugin when their identifying values differ. For example, a consumer can rotate a key by creating a second key-auth credential, switching clients to the new key, and then deleting the old credential. Credential details are stored separately and are not included when you retrieve the consumer object.

The following diagram illustrates an example of credentials using two routes, each with one type of authentication enabled, and one consumer, whose authentication details are configured in credentials. Only requests with the valid credentials will be authenticated and allowed to access the upstream resource:

Note that when a consumer is successfully authenticated, APISIX adds additional headers, such as consumer username and identifier, to the request before proxying it to the upstream service. The upstream service will be able to differentiate between consumers and implement additional logic as needed.

Additional Resources

• Key Concepts - Consumers
• Getting Started - Key Authentication
• Admin API - Credentials