Kong API Gateway: JWT, Rate Limiting, and Monitoring Setup

Problem: API management without a centralized gateway

Microservice architecture quickly grows: dozens of endpoints appear, authentication is duplicated, rate limiting is implemented differently in each service, monitoring is fragmented. We've seen teams spend weeks just to agree on log formats and security rules. Kong API Gateway — an open-source solution based on nginx/OpenResty — centralizes these tasks: routing, plugins (JWT, rate limiting, CORS, Prometheus), and declarative configuration. Over 7+ years we have deployed Kong in more than 50 projects, from startups to enterprise.

What problems we solve

• Bloated authentication: each microservice has its own JWT parser — code duplication and bugs. Kong handles authentication, validates JWT at the entry point, and passes internal headers. This reduces service code and increases security.
• Rate limiting "on the knee": limits in code are inflexible and hard to change without redeployment. Kong supports rate limiting with Redis — up to 100,000 requests per minute per consumer, with different policies (local, Redis, cluster).
• Lack of observability: without a single point it is difficult to collect metrics. Kong exports to Prometheus the number of requests, latencies (p50/p99), statuses — straight to Grafana.

How Kong solves the authentication duplication problem

Kong acts as a single entry point: all requests first pass through the gateway, where JWT is validated. If the token is valid, Kong adds headers (x-consumer-id, x-user-id) and forwards the request to the microservice. The service can trust these headers without implementing its own check. This reduces code duplication by 40% and lowers the probability of security errors.

How we configure Kong turnkey

We use Kong 3.x (current version) with PostgreSQL or DB-less mode. Below is a typical stack:

version: '3.8'
services:
  kong-db:
    image: postgres:15
    environment:
      POSTGRES_DB: kong
      POSTGRES_USER: kong
      POSTGRES_PASSWORD: kong_password

  kong-migration:
    image: kong:3.5
    command: kong migrations bootstrap
    environment:
      KONG_DATABASE: postgres
      KONG_PG_HOST: kong-db
      KONG_PG_USER: kong
      KONG_PG_PASSWORD: kong_password
    depends_on: [kong-db]

  kong:
    image: kong:3.5
    environment:
      KONG_DATABASE: postgres
      KONG_PG_HOST: kong-db
      KONG_PG_USER: kong
      KONG_PG_PASSWORD: kong_password
      KONG_PROXY_ACCESS_LOG: /dev/stdout
      KONG_ADMIN_ACCESS_LOG: /dev/stdout
      KONG_PROXY_ERROR_LOG: /dev/stderr
      KONG_ADMIN_ERROR_LOG: /dev/stderr
      KONG_ADMIN_LISTEN: 0.0.0.0:8001
      KONG_PROXY_LISTEN: 0.0.0.0:8000, 0.0.0.0:8443 ssl
    ports:
      - "8000:8000"
      - "8443:8443"
      - "8001:8001"
    depends_on: [kong-migration]

Using Admin API commands we create services, routes, and plugins. Example: configuring JWT and rate limiting on the users-api service.

# Create upstream service
curl -X POST http://localhost:8001/services \
  -d name=users-api \
  -d url=http://users-service:3000

# Create route
curl -X POST http://localhost:8001/services/users-api/routes \
  -d 'paths[]=/api/v1/users' \
  -d 'strip_path=false'

# JWT plugin
curl -X POST http://localhost:8001/services/users-api/plugins \
  -d name=jwt

# Rate limiting with Redis
curl -X POST http://localhost:8001/plugins \
  -d name=rate-limiting \
  -d config.minute=100 \
  -d config.hour=5000 \
  -d config.policy=redis \
  -d config.redis_host=redis \
  -d config.redis_port=6379 \
  -d config.limit_by=consumer

_format_version: "3.0"
services:
  - name: users-api
    url: http://users-service:3000
    routes:
      - paths:
          - /api/v1/users
        strip_path: false
    plugins:
      - name: jwt
      - name: rate-limiting
        config:
          minute: 100
          hour: 5000
          policy: redis
          redis_host: redis
          redis_port: 6379
          limit_by: consumer

Work process

1. Analysis: we gather requirements — which services, protocols, limits, whether DB-less is needed.
2. Design: routing scheme, choice of plugins, network setup (TLS, segmentation).
3. Implementation: deploy Kong, import configuration (declarative or via Admin API), integrate with CI/CD.
4. Testing: load testing (e.g., 1000 RPS), authentication checks, correctness.
5. Deployment and documentation: we hand over instructions, diagrams, Grafana dashboards. Train the team.

What is included in the work

• Deployment of Kong (Docker/Kubernetes/bare metal)
• Configuration of routing, JWT, rate limiting, CORS, request transformer
• Monitoring: Prometheus + Grafana (dashboard ID 7424)
• Integration with Redis for rate limiting
• Administration documentation
• 2 days of team training
• 2 weeks of post-launch support

Estimated timelines

From 2 business days (basic configuration) to 7 days (with canary deployments, HA, DB-less). The cost is determined individually — contact us for an estimate.

Comparison of Kong operating modes

DB-less mode is simpler to deploy: no database required, configuration is static and reloaded on each change. Dynamic mode with PostgreSQL allows changing settings on the fly via Admin API but adds a point of failure. We help choose the appropriate option for your scenarios: if routes change frequently, choose DB; if configuration is stable, DB-less.

Comparison of popular Kong plugins

Why choose Kong for your API?

Kong is on average 3 times faster than custom solutions in terms of throughput (up to 2 million RPS on a single node) and has a rich plugin ecosystem. We guarantee stability: in our projects, Kong has run without restart for over 6 months.

How we customize Kong to your specifics

For each project we adapt DB-less or dynamic mode, choose plugins (key-auth, OAuth2, IP restriction), configure canary deployments via weighted targets. For example, we distribute traffic 90%/10% between service versions. Contact us for a consultation — we'll offer a free architecture for your project. Order Kong implementation and get a reliable API gateway from scratch.

API Development with REST, GraphQL, WebSocket, and tRPC

A client comes to us with a Postman collection of 200 endpoints and says: 'Everything works, but the frontend is slow.' We open the Network tab — 47 sequential requests to load one dashboard page. Each one waits for the previous. This is not a server speed issue — it's an API architecture problem. With 10 years on the market, we've redesigned dozens of such integrations, and we guarantee: the right protocol and contract solve the problem at its root.

When REST stops being enough

REST works well for simple CRUD operations. But as soon as a mobile app appears alongside the web interface, over-fetching begins: the mobile app requests /api/users/123 and gets a 4KB object, but only needs name and avatar. Multiply that by a list of 50 users — 200KB traffic instead of 8KB.

GraphQL solves this with selection sets. The client describes exactly the fields it needs, and the server returns only those. On a project with React Native + Next.js, we migrated from REST to Apollo Server: payload size on the main screen dropped from 340KB to 28KB — a 92% traffic savings. Our certified engineers confirm: the typical pain when adopting GraphQL is N+1 query. A resolver for the author field on a post calls SELECT * FROM users WHERE id = ? for each post in the list. On a page with 20 posts — 21 database queries. Solved with DataLoader — it batches queries and turns them into one SELECT * FROM users WHERE id IN (...).

What is tRPC and how is it better than REST/GraphQL?

If the entire stack is TypeScript (Next.js + Node/Bun), tRPC removes a whole layer of problems. You define a procedure on the server — the client gets full type-safety automatically, without code generation and without Swagger. Renamed a field in the Zod schema — TypeScript highlights all places on the frontend where it's used. tRPC reduces code by 2 times compared to REST + Swagger + openapi-typescript: no need to maintain a separate specification and generate types — everything is inferred from runtime validators. However, tRPC is not suitable if the API is consumed by third-party clients or mobile apps in other languages — in such cases we use GraphQL or REST with OpenAPI specification.

WebSocket and real-time: when SSE, when WS?

HTTP polling every 5 seconds is an illusion of real-time with up to 5 seconds delay and useless server load. For chats, live notifications, collaborative editing — WebSocket or Server-Sent Events. SSE is a one-way stream from server to client, works over ordinary HTTP, automatically reconnects. Suitable for notifications, data streaming, progress bars. WebSocket is bidirectional, needed for chats and collaborative features. Experience shows: 80% of 'real-time' tasks are solved with SSE, not WebSocket — fewer infrastructure complexities.

A typical mistake: opening a WebSocket connection for each page component. On one project, the dashboard opened 12 parallel WS connections. The correct approach is one connection manager at the application level, subscriptions through it. In our work results, we always transfer the connection scheme and a ready solution.

Swagger / OpenAPI as a contract

Documentation written after the fact becomes outdated the day after release. We write the OpenAPI 3.1 specification before development starts; it becomes the contract between frontend and backend. The frontend generates types via openapi-typescript, the backend validates incoming data using generated schemas. Contract deviation from implementation is caught on CI, not during review. For Laravel — l5-swagger or dedoc/scramble. For Node.js — @fastify/swagger or Zod + zod-to-openapi.

How to properly authenticate an API?

JWT with long-lived access tokens without rotation is a source of problems when compromised. The correct scheme: access token for 15 minutes, refresh token for 30 days with rotation on each use. Refresh token stored in an httpOnly cookie, access token in memory (not in localStorage). For inter-service communication — API Keys with scope limitations or mTLS. OAuth 2.0 with PKCE for public clients (SPA, mobile).

How to handle versioning and backward compatibility?

Breaking changes in an API without versioning break clients. Three approaches we use in projects:

We guarantee backward compatibility through automated checks (oasdiff) on CI.

How we develop APIs: step-by-step plan

1. Analysis — audit of current integrations, data schema compilation, protocol selection (REST/GraphQL/tRPC/WebSocket).
2. Contract design — OpenAPI or SDL (GraphQL) before the first line of code.
3. Development — implementation per contract, unit tests for each endpoint.
4. Load testing — k6: 500 virtual users, 10 minutes, p95 latency ≤ 200ms.
5. Deployment — CI/CD with backward compatibility check, automatic documentation publication.
6. Team training — handover of Postman collection or Playground, connection instructions.

What is included (deliverables)

• OpenAPI 3.1 specification (or SDL for GraphQL).
• Generated client types for TypeScript / Dart / Kotlin.
• Set of automated tests covering all endpoints (unit + integration).
• Load tests (k6) and report (p50/p95/p99 latency, RPS).
• Documentation in Swagger UI / Redoc / GraphiQL.
• Team training (2–4 hour workshop).
• Support for 30 days after delivery (per contract).

Our experience

• 10+ years in the API development market.
• 200+ completed projects (REST, GraphQL, WebSocket, tRPC).
• 50+ certified engineers (AWS, Kubernetes, API Design).
• Traffic savings averaging 85% when migrating from REST to GraphQL for mobile apps.
• 100% backward compatibility — not a single broken client in the last 3 years.

Timeline

API development for a typical SaaS project with 30–50 endpoints: from 3 to 8 weeks depending on business logic complexity and number of external integrations. Migration of an existing REST API to GraphQL: from 2 to 6 weeks. Adding a WebSocket layer to an existing backend: from 1 to 3 weeks. Cost is calculated individually after an audit. Get a consultation — contact us to discuss your project.