| name | kong |
| description | Kong API Gateway — routes, services, plugins, Admin API. |
Kong API Gateway
Kong is an open-source API gateway and platform built on Nginx/OpenResty. In Supabase, Kong routes all traffic to internal services (PostgREST, GoTrue, Realtime, Storage, Edge Functions).
Detection Signals
| Signal | Meaning |
|---|
kong service in docker-compose.yml | Self-hosted Kong |
volumes/api/kong.yml in Supabase project | Supabase-embedded Kong config |
KONG_* env vars | Kong configuration |
8000 / 8443 ports exposed | Kong proxy ports |
8001 / 8444 ports exposed | Kong Admin API ports |
Core Concepts
| Concept | Description |
|---|
| Service | An upstream backend (e.g., PostgREST at http://rest:3000) |
| Route | A matching rule (host, path, method) that forwards to a Service |
| Plugin | Middleware attached to a Route, Service, or globally |
| Upstream | Load balancer target with health checks and multiple targets |
| Consumer | A user or application that calls your API (used for auth plugins) |
Supabase-Specific Notes
Declarative config only: Supabase does not use the Kong Admin API — all config is declarative in kong.yml. In self-hosted setups, always edit kong.yml rather than calling the Admin API, or changes will be lost on restart.
strip_path on prefix routes: always set strip_path: true on a route matched by a path prefix — otherwise Kong forwards the prefix to the upstream and the upstream returns 404 for every request.
apikey header: Supabase uses a custom apikey header (the anon or service-role key). The Supabase Kong config validates this via the JWT plugin — the apikey is a valid JWT signed with your JWT_SECRET. Always include apikey in the CORS plugin headers list.
Load on Demand
| When | Load |
|---|
| Configuring plugins (JWT, CORS, rate-limiting, caching) | references/plugins.md |
| Setting up routes, services, Admin API, upstreams | references/routes-services.md |
| Rate limiting strategies or consumer management | references/consumers.md |