Kong Konnect

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me the API gateway control I actually need — noting that **Kong's gateway is open source and running it yourself is free.** The paid product is the control plane.

Two honest options.

OPTION ONE: RUN THE GATEWAY, CONFIGURE IT FROM GIT
- Kong or Caddy or Nginx, configured from files in version control, deployed by your existing pipeline
- **This is better than a hosted control plane for most teams**: the configuration is reviewed, diffed and reverted like everything else
- No control plane to be unavailable

OPTION TWO: BUILD THE THIN GATEWAY, WHICH IS OFTEN ENOUGH

STACK
- Node 20+ with Fastify as the gateway process
- SQLite through better-sqlite3, WAL mode, for keys and counters
- Caddy terminating TLS in front

WHAT A GATEWAY ACTUALLY DOES
- Route by host and path prefix to an upstream
- Authenticate: an API key or a JWT, checked before anything else
- Rate limit per key and per route
- Log every request with a correlation id and a duration
- That is the whole job. Everything else these products sell is around the edges

THE DATA MODEL
- consumers: id, name, status
- keys: id, consumer_id, hash, prefix, scopes_json, created_at, last_used_at, revoked_at
- routes: id, host, path_prefix, upstream, strip_prefix, timeout_ms, auth_required, rate_json
- usage: consumer_id, route_id, minute_bucket, count — counters, not a row per request
- requests: sampled, with correlation id, status and duration

THE RULES THAT KEEP IT SAFE
- **Store a hash of the key, never the key.** Show it once at creation, with a visible prefix so a consumer can identify which key is which
- Rate limit with a fixed window in SQLite for a start; it is enough, and the sliding window can come later
- Return 429 with Retry-After, and rate-limit headers on every response so clients can behave
- **A timeout on every upstream call, always.** Without it one slow backend consumes every connection and the gateway becomes the outage
- Circuit break a failing upstream: after a run of failures, fail fast for a short window rather than queueing
- Never forward the client's own hop-by-hop headers, and set the forwarded-for chain deliberately

OBSERVABILITY
- A correlation id generated at the edge and passed to the upstream in a header. **This is the single most useful thing a gateway gives you** and it costs three lines
- Per-route latency percentiles and error rates, computed at query time from sampled rows
- Alert on error rate and on p99 latency, per route

THE DEVELOPER PORTAL
- A static page per API from your OpenAPI file, plus a self-service key page. That is the portal, and it is a day

WHAT MATTERS MOST
Upstream timeouts and hashed keys. One stops a slow backend taking everything down; the other stops a database leak becoming an account breach.