Hero Image
OAuth 2.0 Token Introspection in Kong

Kong Enterprise includes an official OAuth 2.0 Introspection plugin, but it requires a license. In this lab, we will overcome that limitation by installing an open community or free-software plugin on Kong Gateway 3.10. In addition to the plugin, we will deploy Keycloak in Kubernetes. Keycloak will issue access tokens through client_credentials and expose the introspection endpoint defined by RFC 7662. Every response shown in this article comes from this real scenario.

Sunday, July 26, 2026 | 9 minutes Read
Hero Image
OpenID Connect in Kong

Kong’s official OpenID Connect plugin requires an Enterprise license. In this lab, we use the open community or free-software cuongntr/kong-openid-connect-plugin adapter on top of lua-resty-openidc to complete an Authorization Code flow without a license. We will deploy a separate Keycloak instance in Kubernetes, log in with a real user, and verify both the callback and cookie reuse. Every response in this article comes from the lab VM. This lab continues from Installing KIC. It reuses the kong Gateway, the echo Service, KIC 3.5, and 192.168.121.200 as the kong-gateway-proxy address.

Sunday, July 26, 2026 | 5 minutes Read