Gateway & identity
Gateway authentication
Protect routes with JWT validation or API keys at the edge.
Goal
Require authentication before traffic reaches upstream applications.
Prerequisites
- Routes exist.
- Permission
proxy.gateway.read/proxy.gateway.write.
Supported schemes (MVP)
| Scheme | Behavior |
|---|---|
| None | No gateway auth |
| Jwt | Validate Bearer token via OIDC metadata (JwtAuthority / JwtAudience) |
| ApiKey | Validate via control-plane internal API-key check |
OAuth / mTLS / Combined schemes are not shipped for gateway auth writes.
Steps
- Open Advanced → Gateway (auth policies).
- Create a JWT or API-key policy with the correct authority/audience or key settings.
- Attach the policy to the target route(s).
- Publish.
Verify
- Request without credentials is denied.
- Valid JWT or API key reaches upstream.
- Invalid token does not.