Authentication
For security reasons, API7 Enterprise should authenticate and authorize consumers before they access to internal resources. API7 Enterprise has a flexible plugin extension system and a number of plugins for user authentication and authorization.
- Key Authentication
- Basic Authentication
- JSON Web Token (JWT) Authentication
- Keycloak
- Casdoor
- Wolf RBAC
- OpenID Connect
- Central Authentication Service (CAS)
- HMAC
- Casbin
- LDAP
- Open Policy Agent (OPA)
- Forward Authentication
Key authentication is a relatively simple but widely used authentication approach. Ideally, it works in the following way:
- The administrator adds an authentication key (API key) to the route.
- API consumers add the key to the query string or headers for authentication when sending requests.
Each route can use one authentication mechanism. Do not enable multiple authentication plugins on a single route or enable authentication plugins as global rules.