--- title: "API7 Enterprise v3.2.15: Multi-Credential Authentication - API7.ai" description: "API7 Enterprise v3.2.15 optimizes consumer authentication and permissions management, supporting multiple credentials and refined access control strategies for enhanced API gateway security." url: "https://api7.ai/blog/api7-3.2.15-multi-credential-authentication" --- [Blog](https://api7.ai/blog) [Products](https://api7.ai/category/products)[Technology](https://api7.ai/category/technology)[Ecosystem](https://api7.ai/category/ecosystem)[Case Study](https://api7.ai/category/usercase)[Team & Community](https://api7.ai/category/community) Search ⌘ + K [Blog](https://api7.ai/blog) Products # API7 Enterprise v3.2.15: Multi-Credential Authentication [![Zhihuang Lin](https://github.com/oil-oil.png)](https://github.com/oil-oil) [Zhihuang Lin](https://github.com/oil-oil) September 18, 2024 [Products](https://api7.ai/category/products) As API services become increasingly complex, traditional access control methods relying solely on IP addresses or basic request headers are no longer sufficient. [API7 Enterprise](https://api7.ai/enterprise) introduces the concept of "[Consumers](https://docs.api7.ai/enterprise/key-concepts/consumers)", allowing developers to bind consumers to specific API routes or services with the same authentication plugins enabled. When a consumer makes a request, the API gateway identifies the consumer based on the credentials provided in the request and applies the corresponding access control policies according to the binding relationships. API7 Enterprise v3.2.15 enhances existing consumer authentication mechanisms. It optimizes interactions of commonly used plugins, improves permission control, and supports multiple authentication credentials per plugin. This enables more flexible credential management and rotation. ## Optimized Consumer Authentication Plugin Interaction You can easily add multiple authentication credentials in a single authentication plugin. The configuration has been upgraded from coding to intuitive form operations, making the configuration process simpler. ![Add Credentials](https://static.api7.ai/uploads/2024/09/13/cVsVoknY_credential-2.PNG?imageMogr2/format/webp) Currently, the consumer supports the following four authentication methods with multiple credentials. ### Key Authentication Key Authentication is a key-based authentication method. Consumers need to include a unique key in their requests, which can be included in the query string parameters or HTTP headers. When configuring requests, consumers must ensure that the key is carried in the requests correctly. ![Add Key Authentication](https://static.api7.ai/uploads/2024/09/13/lYcVlBed_credential-3.PNG?imageMogr2/format/webp) In the route or service configuration, the [Key Auth](https://docs.api7.ai/hub/key-auth) plugin needs to be enabled with the appropriate rules to validate the key in the request. The gateway checks whether the request contains the expected key and whether the key matches the configuration. If the key validation passes, the request is allowed to access the backend service; if it fails, the request is denied. ### Basic Authentication Basic Authentication is a method based on a username and password. Consumers need to include authentication information containing the username and password in the request, usually encoded in the `Authorization` header of the HTTP request but can also be passed via query string parameters, though unrecommended due to potential exposure of sensitive information. Consumers must ensure that the encoded authentication information is correctly included when configuring requests. ![Add Basic Authentication Credential](https://static.api7.ai/uploads/2024/09/13/gSWNyGxx_credential-4.PNG?imageMogr2/format/webp) In the route or service configuration, the [Basic Auth](https://docs.api7.ai/hub/basic-auth) plugin needs to be enabled with the appropriate rules to validate the authentication information. The gateway checks whether the request includes `Authorization` header and follows the Basic Authentication format. The format is `Basic `, where `` is the Base64-encoded result of the username and password separated by a colon. The gateway decodes this value and compares the decoded username and password against the configured information. If they match, the request is allowed access to the backend service; if not, the request is denied. Note that Basic Authentication transmits the username and password in plain text, only encoded in Base64 (not encrypted), which makes it unsuitable for high-security scenarios. ### JWT Authentication [JWT Authentication](https://docs.api7.ai/hub/jwt-auth) is a method based on JSON Web Tokens (JWT). Consumers must include a valid JWT token in their requests, usually in the `Authorization` header using the Bearer `` format but can also be placed in query string parameters or cookies as needed. Consumers must ensure the correctness and validity of the JWT token when configuring requests. When adding JWT credentials, you can configure key elements of the JWT token generation, including the Key (public or private key) for signing and verification, the Secret (key for symmetric encryption), the algorithm used (e.g., HMAC-SHA256 or RSA-SHA256), and the expiration time to set the token's validity period. Only consumers holding valid and unexpired tokens can successfully access protected backend services. ![Add JWT Authentication Credential](https://static.api7.ai/uploads/2024/09/13/cpt0AWpA_credential-5.PNG?imageMogr2/format/webp) ### HMAC Authentication HMAC Authentication is a method based on Hash-based Message Authentication Code (HMAC). Consumers need to generate an HMAC value for the request, usually calculated using a pre-shared key and specific parts of the request (e.g., request method, URI, request body). This HMAC value can be included in query string parameters or HTTP headers. When configuring requests, consumers must generate and include the HMAC value correctly according to the specified algorithm and format. Specifically, consumers use a known key and request information to generate the HMAC using a hashing algorithm (e.g., SHA-256) and append it to the request. ![Add HMAC Authentication Credential](https://static.api7.ai/uploads/2024/09/13/ihgZ5oqv_credential-6.png?imageMogr2/format/webp) In the route or service configuration, the [HMAC Auth](https://docs.api7.ai/hub/hmac-auth) plugin needs to be enabled with appropriate rules to validate the HMAC value in the request. The gateway checks whether the HMAC value is present in the request and recalculates the HMAC using the same pre-shared key and algorithm to verify its validity. If the recalculated HMAC matches the value in the request, the request is allowed to access the backend service. ## Granular Consumer Permission Policies In addition to optimizing credential management, we have further refined consumer permission management. You can now define permissions down to the level of individual consumers, enabling more granular access control. Read and write permissions for authentication credentials are now controlled independently, separate from consumer permissions, providing greater flexibility. ## Summary The latest version of API7 Enterprise introduces major improvements to consumer authentication and permission management. It optimizes plugin interactions, enables independent credential management, supports multiple authentication methods, and refines consumer permission strategies. These enhancements boost credential management flexibility, system security, and overall user experience. Future updates may introduce additional authentication methods and further refine credential management, offering more innovative features and an improved user experience. Tags: [RBAC](https://api7.ai/tags/rbac) [Permission Management](https://api7.ai/tags/permission-management) [API7 Enterprise](https://api7.ai/tags/api7-enterprise) Share article link Share Related Posts [![Announcing API7 Enterprise 3.7.0](https://static.api7.ai/uploads/2025/04/22/uCwEnhC3_api7-enterprise-3.7.0.webp)](https://api7.ai/blog/release-api7-enterprise-3.7) ## [Announcing API7 Enterprise 3.7.0](https://api7.ai/blog/release-api7-enterprise-3.7) [![Announcing API7 Enterprise 3.6.0](https://static.api7.ai/uploads/2025/03/25/u0IUnqd5_api7-enterprise-3.6.0.webp)](https://api7.ai/blog/release-api7-enterprise-3.6) ## [Announcing API7 Enterprise 3.6.0](https://api7.ai/blog/release-api7-enterprise-3.6) Table of Contents - [Optimized Consumer Authentication Plugin Interaction](#optimized-consumer-authentication-plugin-interaction) - [Key Authentication](#key-authentication) - [Basic Authentication](#basic-authentication) - [JWT Authentication](#jwt-authentication) - [HMAC Authentication](#hmac-authentication) - [Granular Consumer Permission Policies](#granular-consumer-permission-policies) - [Summary](#summary) ## Related Posts [![API7 Enterprise 3.2.14.4: Permission Boundary for Refined Permission Management](https://static.api7.ai/uploads/2025/02/13/L4wPiOVN_3.2.14.4-permission-boundaries.png)](https://api7.ai/blog/api7-3.2.14.4-policy-permission-and-boundary) Products August 15, 2024 #### [API7 Enterprise 3.2.14.4: Permission Boundary for Refined Permission Management](https://api7.ai/blog/api7-3.2.14.4-policy-permission-and-boundary) API7 Enterprise 3.2.14.4 introduces permission boundaries to help enterprises achieve more granular user permission management, thus improving system security and control. [RBAC](https://api7.ai/tags/rbac) [Permission Management](https://api7.ai/tags/permission-management) [API7 Enterprise](https://api7.ai/tags/api7-enterprise) [![API7 Enterprise 3.10.0: Simpler Service Management, Stronger Security, and Better AI Traffic Reliability](https://static.api7.ai/uploads/2026/07/06/e8rTH3tK_api7-enterprise-3.10.webp)](https://api7.ai/blog/api7-enterprise-3-10-service-management-security-ai-reliability) Products June 1, 2026 #### [API7 Enterprise 3.10.0: Simpler Service Management, Stronger Security, and Better AI Traffic Reliability](https://api7.ai/blog/api7-enterprise-3-10-service-management-security-ai-reliability) API7 Enterprise 3.10.0 simplifies service management, strengthens security defaults, and improves AI traffic reliability for platform teams. [API7 Gateway](https://api7.ai/tags/api7-gateway) [API7 Enterprise](https://api7.ai/tags/api7-enterprise) [AI Gateway](https://api7.ai/tags/ai-gateway) [![Manage User Permissions Effortlessly Using API7-MCP](https://static.api7.ai/uploads/2025/05/16/W28u7bSD_api7-mcp-user-permission-cover.webp)](https://api7.ai/blog/api7-mcp-for-permission-management) Products May 12, 2025 #### [Manage User Permissions Effortlessly Using API7-MCP](https://api7.ai/blog/api7-mcp-for-permission-management) Discover how API7-MCP simplifies permission management in API7 Enterprise using natural language, reducing complexity and enhancing security. [Permission Management](https://api7.ai/tags/permission-management)