Secrets

In this document, you will learn the basic concept of Secrets and Secret Providers in API7 Gateway and why you may need them.

Explore additional resources at the end of the document for more information on related topics.

Overview

A secret object is a piece of sensitive information that needs to be protected from unauthorized access, while a secret provider object is used to set up integration with an external secret manager (HashiCorp Vault, AWS Secret Manager, etc.), so that API7 Gateway can establish connections and fetch secrets from the secret manager dynamically at runtime.

By storing secrets in a dedicated secret management service, you can:

• Reduce the risk of data breaches: Minimize the exposure of sensitive information within your API7 Gateway.
• Simplify management: Centralize the storage and retrieval of secrets, streamlining configuration and maintenance.
• Enhance security: Leverage the advanced security features and auditing capabilities of external secret managers.
• Improve compliance: Ensure compliance with industry regulations and best practices for data protection.

Use Cases

Secure Consumer Credentials

The following sensitive fields in consumer credentials can be stored in an external secret manager (HashiCorp Vault, AWS Secret Manager, etc.) and referenced in API7 Gateway:

• key in Key Authentication credential
• password in Basic Authentication credential
• secret, public key in JWT Authentication credential
• secret key in HMAC Authentication credential

For detailed tutorial, please refer to Manage Consumer Credentials.

Secure Sensitive Fields in Plugin Configuration

Starting from version 3.9.11, secret references ($secret://, $env://) are resolved centrally and work with any plugin configuration field automatically. You can store any sensitive value in an external secret manager and reference it in any plugin configuration.

In versions prior to 3.9.11, only the following plugins had explicit secret reference support:

Plugin	Field
Limit Count	redis_username, redis_password
Authz-Casdoor	client_id, client_secret
Wolf RBAC	appid
LDAP Authentication	user_dn

For example, see Apply Rate Limiting to APIs and use secret in plugin configuration.

Additional Resources

• Key Concepts
  • Plugins
  • Consumers
• API Security
  • Reference Secrets in HashiCorp Vault
  • Reference Secrets in AWS Secret Manager
  • Reference Secrets in Kubernetes Secret
• API Consumption
  • Manage Consumer Credentials
  • Apply Rate Limiting to APIs