Note: When you have more than three microservices, duplicating token validation logic in each becomes a headache. Each service hits the database or an external IdP to validate JWT, adding 20–50 ms latency per request and complicating security audits. You get N+1 checks, an increased attack surface, and token revocation requires synchronization across all services. We offer to move authentication and authorization to the API Gateway layer. The request is checked once, services receive verified data via HTTP headers. This approach reduces latency up to five times, simplifies maintenance, and provides a single audit point. It cuts security infrastructure costs by up to 40% through centralization. Average operational cost savings are 35%. Our experience: over 5 years, more than 30 API Gateway projects. We provide a turnkey service with a 6-month warranty. Get turnkey authentication—contact us for a consultation.
How API Gateway Solves the Duplicate Authentication Problem?
The Gateway becomes the single entry point: the client sends a request, the Gateway checks the token (JWT/OAuth2/API Key), extracts claims, and passes them to upstream services via headers. Services fully trust the Gateway and do not validate tokens themselves. Direct access to services is blocked by network policies. Centralized authentication simplifies security audits threefold compared to a distributed scheme.
Client → [API Gateway: validate JWT, extract claims] → Service ↑ X-User-ID, X-Role, X-Tenant headers How It Works
For each request, the Gateway performs: signature and expiry validation, claim extraction, access control check (ACL), header forwarding to upstream. Validation takes under 5 ms.
Which Authentication Protocols Are Supported?
We configure all popular schemes. Comparison of implementation time:
| Protocol | Scenario | Implementation Time |
|---|---|---|
| JWT (RS256/HS256) | Internal APIs, mobile | 2–3 days |
| OAuth2 (authorization code) | External clients, integrations | 3–4 days |
| OIDC | Single Sign-On, enterprise | 3–5 days |
| mTLS | Service-to-service, B2B | 4–5 days |
Each protocol has its own nuances—we'll cover them with examples.
JWT Validation in Kong
Example JWT plugin configuration in Kong
Setting up basic JWT validation in Kong takes a few minutes:
# Enable JWT plugin curl -X POST http://localhost:8001/plugins \ -d "name=jwt" # Create consumer and credentials curl -X POST http://localhost:8001/consumers \ -d "username=frontend-app" curl -X POST http://localhost:8001/consumers/frontend-app/jwt \ -d "algorithm=RS256" \ -d "rsa_public_key=$(cat /keys/public.pem)" The client sends Authorization: Bearer <JWT>. Kong verifies the signature and expiry—on error returns 401. See Kong JWT plugin for details.
OIDC in APISIX with Keycloak
For Keycloak integration, we use the openid-connect plugin:
{ "plugins": { "openid-connect": { "client_id": "api-gateway", "client_secret": "secret", "discovery": "https://keycloak.company.com/realms/myapp/.well-known/openid-configuration", "scope": "openid profile", "token_signing_alg_values_expected": ["RS256"], "set_access_token_header": true, "set_userinfo_header": true } } } After configuration, the Gateway automatically validates the ID token and forwards userinfo to upstream.
How to Set Up RBAC and Lambda Authorizer?
To restrict access to endpoints by role, we use RBAC; for complex logic, custom authorizers.
RBAC Configuration on the Gateway
In Kong, RBAC is implemented via the ACL plugin. Create groups and assign consumers:
# ACL plugin for admin-api service curl -X POST http://localhost:8001/services/admin-api/plugins \ -d "name=acl" \ -d "config.allow[]=admin-group" \ -d "config.hide_groups_header=true" # Assign consumer alice to admin-group curl -X POST http://localhost:8001/consumers/alice/acl \ -d "group=admin-group" Custom Lambda Authorizer
For resources with flexible permissions (e.g., tenant-based access), we use AWS Lambda Authorizer. It receives the JWT, extracts claims, and returns an IAM policy with context.
How Are Claims Passed and Refresh Token Handled?
After validation, the Gateway adds headers—services get the user context. To prevent session interruptions, we implement automatic token refresh.
-- Kong plugin: extract claims from JWT local jwt_decoder = require "kong.plugins.jwt.jwt_parser" local function execute(conf) local token = kong.request.get_header("authorization") if token then token = token:gsub("Bearer ", "") local jwt_obj = jwt_decoder:new(token) local claims = jwt_obj.claims kong.service.request.set_header("X-User-ID", claims.sub) kong.service.request.set_header("X-Tenant-ID", claims.tenant_id) kong.service.request.set_header("X-User-Role", claims.role) end end Performance Comparison: With and Without Gateway
| Scenario | Average Request Latency | Token Checks | Security Audit |
|---|---|---|---|
| Without Gateway | 20–50 ms per service | N+1 (each service) | Complex, distributed |
| With Gateway | 5–10 ms (single check) | 1 | Single point |
Gateway reduces latency by 2–5x and simplifies auditing.
Step-by-Step Implementation Process
- Architecture analysis—review current authentication scheme, identify protocols and IdP.
- Gateway selection—choose solution (Kong, APISIX, AWS API Gateway, Traefik, Nginx) based on load and budget.
- Authentication setup—connect JWT/OAuth2/OIDC/mTLS, integrate with IdP (Keycloak, Auth0, Okta).
- Authorization implementation—configure RBAC/ABAC, custom policies via Lambda Authorizer.
- Testing and deployment—test scenarios (token lifetime, refresh, revocation) and deploy to staging/production.
What's Included in the Implementation?
- Analysis of current architecture and scheme selection (JWT/OAuth2/OIDC/mTLS).
- Gateway configuration (Kong, APISIX, AWS API Gateway, Traefik, Nginx).
- Integration with Identity Provider (Keycloak, Auth0, Okta, custom IdP).
- Claim forwarding in headers, RBAC/ABAC implementation.
- Custom Lambda Authorizer development if needed.
- Documentation for developers and team training.
- 2-week support after delivery.
Timelines
Basic JWT/OIDC authentication with RBAC: 2 to 3 business days. With custom Lambda Authorizer and mTLS: up to 5 days. For an individual cost and timeline estimate for your project, contact us. Order implementation now—get a free consultation.