a6-plugin-consumer-restriction

Configure APISIX consumer-restriction by using the a6 CLI to apply whitelist or blacklist rules to routes and services. This enforces access control based on authenticated consumer identity, including consumer name, group, or specific route.

Whitelist mode permits access only to specified consumers, while blacklist mode explicitly denies access to listed consumers. Both modes can restrict traffic by consumer name, consumer group, service, or route.

Yes, configure allowed_by_methods in the consumer-restriction plugin to restrict specific HTTP methods per consumer. This allows granular access control by limiting which HTTP verbs a consumer can use on a route.

Use a6 commands route create or route update to attach the consumer-restriction plugin to your target route. Then execute config sync to deploy the access control rules to your APISIX instance.

Yes, you must create authenticated consumers using a6 consumer create or consumer update before applying restrictions. The plugin enforces access control by validating requests against these configured consumer identities.

APISIX access control targets four restriction types: consumer_name, consumer_group_id, service_id, and route_id. This allows you to restrict access by individual consumer, consumer groups, or specific API endpoints.