Skip to main content
API7.ai Logo

Parameters​

See plugin common configurations for configuration options available to all plugins.

Credentials​

The following are plugin attributes available for configurations on credentials.

  • username

    string

    required

    Unique basic auth username for a consumer.

  • password

    string

    required

    Basic auth password for the consumer.

    In API7 Enterprise 3.9.20 and 3.10.7, the password must not be empty, and a password containing colons is accepted. Following RFC 7617, everything after the first colon of the decoded credentials is taken as the password. Whitespace is still stripped from both halves of the decoded credentials before they are compared, so a password containing spaces cannot be used.

    The password is encrypted with AES before being stored in etcd. You can also store it in an environment variable and reference it using the $env:// prefix, or in a secret manager such as HashiCorp Vault's KV secrets engine, and reference it using the $secret:// prefix. For more information, see secrets.

    A $env:// or $secret:// reference that resolves to an empty value still passes configuration validation, because references are resolved at request time. From API7 Enterprise 3.9.20 and 3.10.7, the gateway fails closed in that case, rejecting every request for the consumer with HTTP 401 and logging a warning.

Routes or Services​

The following are plugin attributes available for configurations on routes or services.

  • hide_credentials

    boolean

    default: false

    If true, do not pass the authorization request header to upstream services.

  • anonymous_consumer

    string

    Anonymous consumer name. If configured, allow anonymous users to bypass the authentication. See Rate Limit with Anonymous Consumer for more details.

  • realm

    string

    default: basic

    Realm in the WWW-Authenticate response header returned with a 401 Unauthorized response due to authentication failure. For example:

    • If realm is set to basic-auth, the 401 response will include the following header:

      WWW-Authenticate: Basic realm="basic-auth"

    • If realm is not configured, the 401 response will include the following header:

      WWW-Authenticate: Basic realm="basic"

    This parameter is available in API7 Enterprise version 3.9.2 and later, and in Apache APISIX version 3.15.0 and later.