$npx -y skills add Dev-Toolbelt/dev-team-agents --skill kong --agent claude-code
Installs into .claude/skills of the current project.
Are you the author of Kong?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/dev-toolbelt-kong)
---
name: kong
description: Kong API Gateway — routes, services, plugins, Admin API.
---
# Kong API Gateway
Kong is an open-source API gateway and platform built on Nginx/OpenResty. In Supabase, Kong routes all traffic to internal services (PostgREST, GoTrue, Realtime, Storage, Edge Functions).
## Detection Signals
| Signal | Meaning |
|---|---|
| `kong` service in `docker-compose.yml` | Self-hosted Kong |
| `volumes/api/kong.yml` in Supabase project | Supabase-embedded Kong config |
| `KONG_*` env vars | Kong configuration |
| `8000` / `8443` ports exposed | Kong proxy ports |
| `8001` / `8444` ports exposed | Kong Admin API ports |
## Core Concepts
| Concept | Description |
|---|---|
| **Service** | An upstream backend (e.g., PostgREST at `http://rest:3000`) |
| **Route** | A matching rule (host, path, method) that forwards to a Service |
| **Plugin** | Middleware attached to a Route, Service, or globally |
| **Upstream** | Load balancer target with health checks and multiple targets |
| **Consumer** | A user or application that calls your API (used for auth plugins) |
## Supabase-Specific Notes
**Declarative config only**: Supabase does not use the Kong Admin API — all config is declarative in `kong.yml`. In self-hosted setups, always edit `kong.yml` rather than calling the Admin API, or changes will be lost on restart.
**`strip_path` on prefix routes**: always set `strip_path: true` on a route matched by a path prefix — otherwise Kong forwards the prefix to the upstream and the upstream returns 404 for every request.
**`apikey` header**: Supabase uses a custom `apikey` header (the anon or service-role key). The Supabase Kong config validates this via the JWT plugin — the `apikey` is a valid JWT signed with your `JWT_SECRET`. Always include `apikey` in the CORS plugin `headers` list.
## Load on Demand
| When | Load |
|------|------|
| Configuring plugins (JWT, CORS, rate-limiting, caching) | `references/plugins.md` |
| Setting up routes, services, Admin API, upstreams | `references/routes-services.md` |
| Rate limiting strategies or consumer management | `references/consumers.md` |
