Kong brokers agent credentials
By OpenTools Team
Access and possession remain distinct.
Access
Kong’s November 4 release says Token Vault is generally available within Kong Identity. Agents authenticate using their own identity; Kong determines what each may access. For authorized downstream requests, the vault brokers credentials at runtime rather than giving them to the agent.1
Boundary
That separates proving identity, authorizing access and handling a secret. It does not prove every permitted action is safe. The announcement is a vendor description, not an independent security test or a guarantee covering every integration.1
Archive computer‑access card; context, not Kong’s mechanism or equipment. Photo: Kendra N. Fulton / U.S. Air Force; distributed by NIST / Wikimedia Commons. U.S. government work; public domain in the United States. Resized and display‑cropped.
Sources
- 1.konghq.com (konghq.com)
- 2.Wikimedia Commons (commons.wikimedia.org)
- 3.flickr.com (flickr.com)