Protected resource metadatav3.16+
Use the OpenID Connect plugin to advertise this API as an OAuth 2.0 protected resource, as defined by RFC 9728. This lets OAuth and OpenID Connect clients, including MCP (Model Context Protocol) clients, automatically discover which authorization server protects this API and which scopes it supports.
When configured, the OIDC plugin serves a metadata document at a well-known URI derived from resource, and adds a resource_metadata attribute (and a scope attribute, if scopes_supported is set) to the WWW-Authenticate header on 401 Unauthorized responses.
This example pairs protected resource metadata with JWT access token (bearer) authentication.
A client that presents no token, or an invalid one, receives a 401 response whose WWW-Authenticate header points it to the metadata document.
For more detail, see Protected resource metadata.
Prerequisites
- An identity provider that issues bearer tokens for this API.
Environment variables
-
ISSUER: The issuer authentication URL for the authorization server that protects this API. For example, if you’re using Keycloak as your IdP, the issuer URL looks like this:http://localhost:8080/realms/example-realm. -
RESOURCE: The URI of this protected resource, for examplehttps://api.example.com/mcp. This is also used to derive the well-known metadata endpoint path. -
SCOPE: A scope supported by this protected resource, for examplemcp:read.
Add this section to your kong.yaml configuration file:
_format_version: "3.0"
plugins:
- name: openid-connect
config:
issuer: ${{ env "DECK_ISSUER" }}
auth_methods:
- bearer
protected_resource_metadata:
resource: ${{ env "DECK_RESOURCE" }}
authorization_servers:
- ${{ env "DECK_ISSUER" }}
scopes_supported:
- ${{ env "DECK_SCOPE" }}Make the following request:
curl -i -X POST http://localhost:8001/plugins/ \
--header "Accept: application/json" \
--header "Content-Type: application/json" \
--data '
{
"name": "openid-connect",
"config": {
"issuer": "'$ISSUER'",
"auth_methods": [
"bearer"
],
"protected_resource_metadata": {
"resource": "'$RESOURCE'",
"authorization_servers": [
"'$ISSUER'"
],
"scopes_supported": [
"'$SCOPE'"
]
}
}
}
'Make the following request:
curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/plugins/ \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "openid-connect",
"config": {
"issuer": "'$ISSUER'",
"auth_methods": [
"bearer"
],
"protected_resource_metadata": {
"resource": "'$RESOURCE'",
"authorization_servers": [
"'$ISSUER'"
],
"scopes_supported": [
"'$SCOPE'"
]
}
}
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
controlPlaneId: Theidof the control plane.
See the Konnect Control Planes Config API reference to learn about region-specific URLs and personal access tokens.
echo "
apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
name: openid-connect
namespace: kong
annotations:
kubernetes.io/ingress.class: kong
labels:
global: 'true'
config:
issuer: '$ISSUER'
auth_methods:
- bearer
protected_resource_metadata:
resource: '$RESOURCE'
authorization_servers:
- '$ISSUER'
scopes_supported:
- '$SCOPE'
plugin: openid-connect
" | kubectl apply -f -Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration to create a Konnect Gateway Plugin:
resource "konnect_gateway_plugin_openid_connect" "my_openid_connect" {
enabled = true
config = {
issuer = var.issuer
auth_methods = ["bearer"]
protected_resource_metadata = {
resource = var.resource
authorization_servers = [var.issuer]
scopes_supported = [var.scope]
}
}
control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "issuer" {
type = string
}
variable "resource" {
type = string
}
variable "scope" {
type = string
}Add this section to your kong.yaml configuration file:
_format_version: "3.0"
plugins:
- name: openid-connect
service: serviceName|Id
config:
issuer: ${{ env "DECK_ISSUER" }}
auth_methods:
- bearer
protected_resource_metadata:
resource: ${{ env "DECK_RESOURCE" }}
authorization_servers:
- ${{ env "DECK_ISSUER" }}
scopes_supported:
- ${{ env "DECK_SCOPE" }}Make sure to replace the following placeholders with your own values:
serviceName|Id: Theidornameof the service the plugin configuration will target.
Make the following request:
curl -i -X POST http://localhost:8001/services/{serviceName|Id}/plugins/ \
--header "Accept: application/json" \
--header "Content-Type: application/json" \
--data '
{
"name": "openid-connect",
"config": {
"issuer": "'$ISSUER'",
"auth_methods": [
"bearer"
],
"protected_resource_metadata": {
"resource": "'$RESOURCE'",
"authorization_servers": [
"'$ISSUER'"
],
"scopes_supported": [
"'$SCOPE'"
]
}
}
}
'Make sure to replace the following placeholders with your own values:
serviceName|Id: Theidornameof the service the plugin configuration will target.
Make the following request:
curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/services/{serviceId}/plugins/ \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "openid-connect",
"config": {
"issuer": "'$ISSUER'",
"auth_methods": [
"bearer"
],
"protected_resource_metadata": {
"resource": "'$RESOURCE'",
"authorization_servers": [
"'$ISSUER'"
],
"scopes_supported": [
"'$SCOPE'"
]
}
}
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
controlPlaneId: Theidof the control plane. -
serviceId: Theidof the service the plugin configuration will target.
See the Konnect Control Planes Config API reference to learn about region-specific URLs and personal access tokens.
echo "
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
name: openid-connect
namespace: kong
annotations:
kubernetes.io/ingress.class: kong
config:
issuer: '$ISSUER'
auth_methods:
- bearer
protected_resource_metadata:
resource: '$RESOURCE'
authorization_servers:
- '$ISSUER'
scopes_supported:
- '$SCOPE'
plugin: openid-connect
" | kubectl apply -f -Next, apply the KongPlugin resource by annotating the service resource:
kubectl annotate -n kong service SERVICE_NAME konghq.com/plugins=openid-connectPrerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration to create a Konnect Gateway Plugin:
resource "konnect_gateway_plugin_openid_connect" "my_openid_connect" {
enabled = true
config = {
issuer = var.issuer
auth_methods = ["bearer"]
protected_resource_metadata = {
resource = var.resource
authorization_servers = [var.issuer]
scopes_supported = [var.scope]
}
}
control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
service = {
id = konnect_gateway_service.my_service.id
}
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "issuer" {
type = string
}
variable "resource" {
type = string
}
variable "scope" {
type = string
}Add this section to your kong.yaml configuration file:
_format_version: "3.0"
plugins:
- name: openid-connect
route: routeName|Id
config:
issuer: ${{ env "DECK_ISSUER" }}
auth_methods:
- bearer
protected_resource_metadata:
resource: ${{ env "DECK_RESOURCE" }}
authorization_servers:
- ${{ env "DECK_ISSUER" }}
scopes_supported:
- ${{ env "DECK_SCOPE" }}Make sure to replace the following placeholders with your own values:
routeName|Id: Theidornameof the route the plugin configuration will target.
Make the following request:
curl -i -X POST http://localhost:8001/routes/{routeName|Id}/plugins/ \
--header "Accept: application/json" \
--header "Content-Type: application/json" \
--data '
{
"name": "openid-connect",
"config": {
"issuer": "'$ISSUER'",
"auth_methods": [
"bearer"
],
"protected_resource_metadata": {
"resource": "'$RESOURCE'",
"authorization_servers": [
"'$ISSUER'"
],
"scopes_supported": [
"'$SCOPE'"
]
}
}
}
'Make sure to replace the following placeholders with your own values:
routeName|Id: Theidornameof the route the plugin configuration will target.
Make the following request:
curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/routes/{routeId}/plugins/ \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "openid-connect",
"config": {
"issuer": "'$ISSUER'",
"auth_methods": [
"bearer"
],
"protected_resource_metadata": {
"resource": "'$RESOURCE'",
"authorization_servers": [
"'$ISSUER'"
],
"scopes_supported": [
"'$SCOPE'"
]
}
}
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
controlPlaneId: Theidof the control plane. -
routeId: Theidof the route the plugin configuration will target.
See the Konnect Control Planes Config API reference to learn about region-specific URLs and personal access tokens.
echo "
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
name: openid-connect
namespace: kong
annotations:
kubernetes.io/ingress.class: kong
config:
issuer: '$ISSUER'
auth_methods:
- bearer
protected_resource_metadata:
resource: '$RESOURCE'
authorization_servers:
- '$ISSUER'
scopes_supported:
- '$SCOPE'
plugin: openid-connect
" | kubectl apply -f -Next, apply the KongPlugin resource by annotating the httproute or ingress resource:
kubectl annotate -n kong httproute konghq.com/plugins=openid-connectkubectl annotate -n kong ingress konghq.com/plugins=openid-connectPrerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration to create a Konnect Gateway Plugin:
resource "konnect_gateway_plugin_openid_connect" "my_openid_connect" {
enabled = true
config = {
issuer = var.issuer
auth_methods = ["bearer"]
protected_resource_metadata = {
resource = var.resource
authorization_servers = [var.issuer]
scopes_supported = [var.scope]
}
}
control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
route = {
id = konnect_gateway_route.my_route.id
}
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "issuer" {
type = string
}
variable "resource" {
type = string
}
variable "scope" {
type = string
}