Manage API Consumers with Apache APISIX

By publishing APIs through Apache APISIX API Gateway, you can easily secure API access using consumer keys or sometimes it can be referred to as subscription keys. Developers who need to consume the published APIs must include a valid subscription key in HTTP requests when calling those APIs. Without a valid subscription key, the calls are rejected immediately by the API gateway and not forwarded to the back-end services.

Consumers can be associated with various scopes: per Plugin, all APIs, or an individual API. There are many use cases for consumer objects in the API Gateway that you get with the combination of its plugins:

Up to now, I assume that the sample project is up and running. To use consumer object along with the other two plugins we need to follow easy steps:

The first cmd creates a new Consumer with API Key based authentication enabled where the API consumer can only make 2 requests against the Product API within 60 seconds.

Then, we define our new Route and Upstream so that all incoming requests to the gateway endpoint /api/products will be forwarded to our example product backend service after a successful authentication process.

Apache APISIX will handle the first two requests as usual, but a third request in the same period will return a 403 HTTP code.

Sample output after calling the API 3 times within 60 sec:

Indeed, after reaching the threshold, the subsequent requests are not allowed by APISIX.

With consumer groups, you can specify any number of rate-limiting tiers and apply them to a group of consumers, instead of managing each consumer individually.

Typical scenarios can be different pricing models for your API Monetization like API Consumers with the basic plan are allowed to make 50 API calls per minute or in another use case, you can enable specific APIs for Admins, Developers, and Guests based on their roles in the system.

For the sake of the demo, let’s create two consumer groups for the basic and premium plans respectively. We can add one or two consumers for each group and control the traffic from consumer groups with the help of the rate-limiting plugin.

To use consumer groups with rate limiting, you need to:

Create a Consumer Group Basic Plan.

Create a Consumer Group Premium Plan.

In the above steps, we set up the rate limiting config for Basic plan to have only 2 requests per 60secs, and the Premium plan has 200 allowed API requests within the the same time window.

Create and add first consumer to the Basic group.

Create and add a second consumer to the Premium group.

Create and add third consumer to the Premium group.

Afterward, we can easily check that the first consumer Consumer1 in the Basic Plan group will get an 403 HTTP status error after hitting the 2 API calls per minute, while the other two consumers in the Premium Plan group can request as many times as they reach the limit.

You can run the below cmd by changing auth key for each consumer in the request header:

Note that you can also add or remove a consumer from any consumer group and enable other built-in plugins.

➔ Watch Video Tutorial:

Related posts:

Quando estamos iniciando um novo empreendimento, em sua maioria, tem dinheiro, recursos e tempo limitados. Por conta disso, adotamos estratégias e procedimentos de forma que não haja desperdício…

Are you looking for Dubai escort service call 0543664803. dubaiescort.services is offering top escort service in Dubai. Find ladies in UAE for incalls or outcalls escort services. Book young and…

Cold and silent they often stand and stare, until you catch a glimpse you wonder if they were even there. They can be dark, they can be bright, they can be misty or faceless. Was it the light playing…