--- title: "Cloud-Native Transformation with APISIX at Essence - API7.ai" description: "The traditional financial company, Essence Securities, selects Apache APISIX as its API gateway, integrating with its diverse plugins and ecosystems." url: "https://api7.ai/blog/essence-securities-selects-apisix" --- [Blog](https://api7.ai/blog) [Products](https://api7.ai/category/products)[Technology](https://api7.ai/category/technology)[Ecosystem](https://api7.ai/category/ecosystem)[Case Study](https://api7.ai/category/usercase)[Team & Community](https://api7.ai/category/community) Search ⌘ + K [Blog](https://api7.ai/blog) Case Study # Cloud-Native Transformation with APISIX at Essence Yonghui Lu January 13, 2023 [Case Study](https://api7.ai/category/usercase) > This article comes from the speech at ApacheCon Asia 2022 by Yonghui Lu, Director of API Gateway in Essence Securities. Yonghui shared the practice of Essence Securities' cloud-native API gateway based on Apache APISIX. ## Overview ### Challenges - The original technology stack was complicated, consisting of NGINX, Spring Cloud Gateway, and self-developed systems - Difficulty in system management due to no unified technology stack - Duplicate work and high costs in various business projects ### Goals - Cloud-native and easy to integrate with the business systems of Essence Securities - To manage the deployment, monitoring, and alerting - High performance and capability of scaling out - Function customization and quick integration with the systems - Enable powerful and abundant functions like [traffic governance](https://apisix.apache.org/blog/2022/03/02/zhongan-usercase-with-apache-apisix/), [security](https://api7.ai/blog/hashicorp-vault-apache-apisix-strengthen-api-security), protocol conversion, authorization, [authentication](https://api7.ai/blog/understanding-microservices-authentication-services), etc. ### Results - Promoted traffic governance, safely managing bursting traffic - Improved R\&D efficiency and convenience - Bolstered Essence Securities' cloud-native development - Enhanced data security and permission management by establishing independent domains ### About Essence Securities Essence Securities Co., Ltd. (Essence Securities) is one of the leading securities corporations in China. Since its establishment in 2006, **Essence Securities has fast become one of China’s Top 15 Securities Companies** with a proven track record of providing the highest services to the private and public sectors. It has four independent subsidiaries and more than **120** retail branches in **25** major provinces nationwide. Essence Securities’ core businesses range from securities brokerage, securities investment consulting, financial advisory services related to securities trade and investment, securities underwriting and sponsorship, securities investment, and asset management to other businesses approved by China Securities Regulatory Commission. ## Why Choose APISIX? Since 2021, Essence Securities started migrating applications to the cloud and conducted an API gateway plan. In 2022, it began to engage in API gateway establishment. After careful comparison, [Essence Securities](https://www.linkedin.com/company/essence-securities-shenzhen-beijing-pr-china) chose [Apache APISIX](https://api7.ai/blog/why-is-apache-apisix-the-best-api-gateway) among a wide range of API gateway solutions for several crucial advantages: ### High-Performance Securities Firms have a typical characteristic: there will be traffic spikes during peak hours. **Apache APISIX is the highest performance API gateway with a single-core QPS of 23,000, with an average delay of only 0.6 milliseconds.** > “We need the API gateway to undertake bursting traffics, and it won’t be our next bottleneck. After we compare [some API gateways](https://api7.ai/apisix-vs-kong) based on OpenResty or some other technology stack, **[Apache APISIX](https://apisix.apache.org/) stands out with its competitive advantage of high performance and can meet our requirements for API gateway.**” Yonghui said. ### Scalable and Developers-Friendly **APISIX supports its users with rich functions. In Essence Securities, [rate-limiting](https://api7.ai/blog/rate-limiting-in-api-management), [circuit breaker](https://apisix.apache.org/blog/2022/08/28/fault-injection-testing-with-api-gateway/#related-resources), authorization and authentication, and [canary release](https://api7.ai/blog/automate-canary-release-decisions-kubernetes-cluster) are the most widely used.** For this, Essence Securities self-developed some plugins to satisfy the internal need of business groups. **APISIX officially supports many programming languages, including [Java](https://github.com/apache/apisix-java-plugin-runner), [Golang](https://github.com/apache/apisix-go-plugin-runner), [Python](https://github.com/apache/apisix-python-plugin-runner), and Lua.** Keeping consistent with the community, Essence Securities chose Lua. As a result, the whole process of development was very smooth. Essence Securities will also consider contributing our self-developed plugins to the community. ### Virtual Machine and Container Scenarios Currently, migrating the application to the cloud is a crucial strategy of Essence Securities. However, there are quite a few scenarios that are deployed on virtual machine. > “**We need to consider the compatibility of these two-state applications** when selecting API gateway, although our plan is more on containers. APISIX provides much support in the scenarios compatiability.” Yonghui said. ### Cloud-Native Developing Track Apache APISIX is marvelous in supporting cloud-native scenarios, while Essence Securities is keeping pace with the cloud-native trend. Using APISIX, APISIX Ingress Controller, and Service Mesh, Essence Securities also looks forward to APISIX’s new advances and development. ### Active Community As an open-source project, APISIX is active in its [community](https://api7.ai/category/community). Issues can be discussed and solved on time. In 2022, nearly 40 in-person and online APISIX community events were hosted by APISIX. People who are familiar with APISIX all feel excited about the activities. ## How is Essence Securities Benefitting from Using APISIX? Below is Essence Securities’ microservices architecture, commonly seen in cloud-native scenarios. ![architecture of fintech api examples](https://static.api7.ai/uploads/2023/01/12/ODoimaEH_1NpkeNlZ3Y.jpeg?imageMogr2/format/webp) - **Authority and Authentication**: Before using APISIX, the authority and authentication were controlled by multiple microservices, resulting in much repetitive developing work. - **Traffic Governance**: Essence Securities realized traffic governance by integrating with APISIX, among which the most typical scenarios are rate-limiting and canary release. Prior to using APISIX, these functions were realized by NGINX, which requires modifying the conf and restarting the nodes. By contrast, **APISIX’s visible [dashboard](https://apisix.apache.org/docs/dashboard/USER_GUIDE/) and hot-reloading feature bring significant convenience to Essence Securities’ traffic governance.** - **Canary Release**: **APISIX is flexible in canary release, which can be achieved by portion and traffic characteristics, covering request header, request parameter, cookie, and so on.** For example, Essence Securities needs to proxy the user traffic to canary-release-version servers by user ID. - **Observability**: Before, Essence Securities needed to realize observable management by metrics, tracing, and logs. It is challenging to make multi-dimension governance come true. However, **only by enabling three plugins with simple configurations can achieve the same effect after using APISIX**. What remarkable progress! ## Innovations Based on APISIX ### CAS single sign-on Essence Securities uses [CAS (Central Authentication Service)](https://en.wikipedia.org/wiki/Central_Authentication_Service) as its standard authentication method, which is suitable for putting the authentication on the gateway. **Essence Securities extends APISIX and adds a new function, CAS single sign-on.** There are several advantages to doing so. Putting CAS on the gateway layer can access CAS and introduce its functions conveniently. For example, there exist unified certification services to fetch users' information. Furthermore, the CAS sets user information to the request header and brings it to the upstream service to save users' login status. Thus it's unnecessary to log in to other systems repetitively, **saving many users' time and improving convenience**. ![single sign-on plugin of Essence Securities api](https://static.api7.ai/uploads/2023/01/11/GwW5sp1d_315b4fc9-6ffe-4639-ab9b-c4196132f57e.jpeg?imageMogr2/format/webp) ### authz - casbin authentication plugin APISIX `authz-casbin` authentication plugin is an authorization plugin based on Lua Casbin. This plugin supports powerful authorization scenarios based on RBAC (role-based access control) model. It supports CSV file storing, APISIX plugin configuration, and storing policy by configuring metadata. Below is an example. ![code example of best fintech api gateway](https://static.api7.ai/uploads/2023/01/11/xT3TGjhn_CiHQzQQBGa.jpg?imageMogr2/format/webp) In Essence Securities, there is an important concept: domain. Users will have different permissions in various domains. For example, employee A is a manager of domain A but might only be a viewer in domain B. ![traffic governance of fintech api gateway](https://static.api7.ai/uploads/2023/01/11/H9AMlUwN_image.jpeg?imageMogr2/format/webp) When defining requests, policies, and roles, the domain should be pointed to. Therefore, Essence Securities modified the casbin to match such a scenario. The plugin relies on the Lua repository, which supports RBAC with domains. Consequently, the requirement above can be satisfied only by calling the corresponding interface of the Lua repository, which is effortless. This way can greatly enhance data security and permission management. ### Observability APISIX provides multi-dimensional monitoring such as metrics, tracing, and logging collection. All of these functions can be achieved by simple configurations. **After enabling the Prometheus plugin, metrics like request delay, bandwidth, and the HTTP status code transmission rate can be observable.** These can be useful in troubleshooting. Regarding **tracing analysis**, when the upstream connects with [Skywalking](https://apisix.apache.org/docs/apisix/plugins/skywalking/), the complete call tracing can be traced once enabling Skywalking. Essence Securities is planning to dig out more value of logging collection. **Pushing the access logs to [kafka](https://apisix.apache.org/docs/apisix/plugins/kafka-logger/) can help Essence Securities analyze and count data.** ## Future Plan ### Multi-tenancy Previously, Essence Securities’ systems have its independent clusters to lower error risks and separate user information. Apache APISIX uses etcd for its configuration center, which is suitable for the current stage. Shared clusters are helpful in unified resource management and improving O\&M efficiency. **Essence Securities would combine independent clusters with multi-tenancy to magnify its management capabilities.** ### Application Marketplace Essence Securities would provide many microservices as products to the users, such as **logging, monitoring, alerting platforms, and data center, the centralized management of which can be realized by APISIX**. After introducing the gateway layer, **many API gateway governance were added, like authentication, authorization, and traffic governance**. ### Observable Data Monitoring APISIX’s plugin kafka-logger can help Essences Securities to push the access log of the gateway to kafka. Kafka can clean, format, and count the information and then obtain more valuable statistics, such as the **Top N of calls, abnormal requests, and request delays**. > “Or we can get status code distribution, client IP distribution, traffic statistics, traffic peak, off-peak hours distribution, abnormal traffic detection, etc. **This part is of great significance for extending the observable capabilities of our system.**” Yonghui said. Essences Securities also looks forward to more cooperation with APISIX Ingress Controller and Service Mesh. ## Looking for APISIX Support? **Apache APISIX is an open-source, dynamic, scalable, and high-performance cloud-native API gateway for all your APIs and microservices.** Being donated to Apache Software Foundation by API7.ai, APISIX has grown into a top-level open-source Apache project. Do you want to accelerate your development with confidence like Essence Securities? To maximize APISIX support, you need [API7](https://api7.ai/). We provide in-depth support for APISIX and API management solutions based on your needs! Contact us now: . Tags: [APISIX Basics](https://api7.ai/tags/apisix-basics) [API Gateway Concept](https://api7.ai/tags/api-gateway-concept) [Fintech](https://api7.ai/tags/fintech) Share article link Share Related Posts [![Sticky Sessions with Apache APISIX: Session Affinity Guide](https://static.api7.ai/uploads/2023/07/28/d33oDxuF_Sticky-Sessions.png)](https://api7.ai/blog/sticky-sessions-theory) ## [Sticky Sessions with Apache APISIX: Session Affinity Guide](https://api7.ai/blog/sticky-sessions-theory) [![Custom Plugin Development For APISIX With Lua And ChatGPT](https://static.api7.ai/uploads/2024/12/25/MssMP69w_custom-plugin-development.png)](https://api7.ai/blog/plugin-development-with-lua-and-chatgpt) ## [Custom Plugin Development For APISIX With Lua And ChatGPT](https://api7.ai/blog/plugin-development-with-lua-and-chatgpt) Table of Contents - [Overview](#overview) - [Challenges](#challenges) - [Goals](#goals) - [Results](#results) - [About Essence Securities](#about-essence-securities) - [Why Choose APISIX?](#why-choose-apisix) - [High-Performance](#high-performance) - [Scalable and Developers-Friendly](#scalable-and-developers-friendly) - [Virtual Machine and Container Scenarios](#virtual-machine-and-container-scenarios) - [Cloud-Native Developing Track](#cloud-native-developing-track) - [Active Community](#active-community) - [How is Essence Securities Benefitting from Using APISIX?](#how-is-essence-securities-benefitting-from-using-apisix) - [Innovations Based on APISIX](#innovations-based-on-apisix) - [CAS single sign-on](#cas-single-sign-on) - [authz - casbin authentication plugin](#authz---casbin-authentication-plugin) - [Observability](#observability) - [Future Plan](#future-plan) - [Multi-tenancy](#multi-tenancy) - [Application Marketplace](#application-marketplace) - [Observable Data Monitoring](#observable-data-monitoring) - [Looking for APISIX Support?](#looking-for-apisix-support) ## Related Posts [![How Cashfree Payments Builds Its Next-Gen API Gateway](https://static.api7.ai/uploads/2025/09/24/M2RqUL2J_cashfree-payments.webp)](https://api7.ai/blog/cashfree-payments-builds-its-next-gen-api-gateway) Case Study September 24, 2025 #### [How Cashfree Payments Builds Its Next-Gen API Gateway](https://api7.ai/blog/cashfree-payments-builds-its-next-gen-api-gateway) Cashfree Payments migrated to API7 Enterprise to manage about 6K TPS and 280K consumers with 99.99% uptime while reducing API-gateway latency and operational cost. [Fintech](https://api7.ai/tags/fintech) [![Charting the Future of Urban Connectivity: WeCity Collaborates with APISIX](https://static.api7.ai/uploads/2023/09/20/6ZpgFEMr_WeCity.png)](https://api7.ai/blog/wecity-uses-apisix) Case Study September 22, 2023 #### [Charting the Future of Urban Connectivity: WeCity Collaborates with APISIX](https://api7.ai/blog/wecity-uses-apisix) APISIX has empowered the WeCity team to effortlessly integrate new data sources, apply custom plans and policies, monitor usage, and effectively monetize their data market. [APISIX Basics](https://api7.ai/tags/apisix-basics) [API Monetization](https://api7.ai/tags/api-monetization) [Data Management](https://api7.ai/tags/data-management) [![How API Gateways Fit into API Management](https://static.api7.ai/uploads/2024/12/25/zQTHfZGV_api-gateway-vs-api-management.jpg)](https://api7.ai/blog/api-gateway-and-api-management-comparison) Technology September 1, 2023 #### [How API Gateways Fit into API Management](https://api7.ai/blog/api-gateway-and-api-management-comparison) Learn how the API gateway runtime fits into API management across lifecycle workflows, developer portals, governance, analytics, security, and operations. [API Gateway Concept](https://api7.ai/tags/api-gateway-concept) [API Management](https://api7.ai/tags/api-management) [APISIX Basics](https://api7.ai/tags/apisix-basics)