skills.rest
lurodrisilva
lurodrisilvaCOMMUNITY
Explore all skills by this author →
GitHub

auth0-kong-authz-authn

Configure and review Auth0 OIDC authentication and authorization on Kong Gateway.

Updated Apr 11, 2026
Search Tags:#authentication#jwt#Kubernetes#API Gateway#Kong#oidc#auth0
One-click install
npx skills add https://github.com/lurodrisilva/personal-skills --skill auth0-kong-authz-authn-lurodrisilva
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auth0-kong-authz-authn
Source: https://github.com/lurodrisilva/personal-skills/tree/main/platform-engineering/auth0-kong-authZ-authN
Command: npx skills add https://github.com/lurodrisilva/personal-skills --skill auth0-kong-authz-authn-lurodrisilva

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Securing APIs at the edge requires correctly wiring Auth0 as the OIDC identity provider into Kong Gateway's openid-connect plugin, and small misconfigurations (missing audience, HS256 signing, wrong issuer trailing slash, no claim-based authorization) silently break or weaken authentication. This Skill encodes the twelve non-negotiable rules and full configuration patterns so every Kong route and Auth0 tenant is fail-closed at the edge. ## Core Features & Use Cases - Gateway-enforced OIDC: Configures the Kong Enterprise openid-connect plugin against Auth0 tenants with JWKS signature verification, audience-pinned tokens, RS256-only signing, and claim-driven authorization via scopes_required, roles_required, groups_required, and audience_required. - Auth0 tenant and application setup: Covers the four Auth0 application types (SPA, Regular Web App, Native, M2M), Resource Server audiences, namespaced custom claims via Actions, refresh-token rotation, and server-side logout through /v2/logout. - Kubernetes GitOps paths: Supports Kong Ingress Controller, Kong Gateway Operator with Gateway API resources (Gateway, HTTPRoute, KongPlugin, KongReferenceGrant), and declarative Auth0 config via alethic/auth0-operator CRDs, Terraform, or Deploy CLI. - Use Case: When reviewing a pull request that adds a KongPlugin of type openid-connect, use this Skill to verify the config declares an audience, an authorization claim, a vault-referenced client_secret, RS256, and an exact-match issuer with trailing slash. ## Quick Start Use the auth0-kong-authz-authn skill to review my KongPlugin openid-connect configuration against Auth0 and flag any violations of the edge authentication rules.

Frequently Asked Questions about auth0-kong-authz-authn

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure the Kong openid-connect plugin with Auth0?▼

Point the plugin's issuer at your Auth0 tenant URL with the trailing slash, set audience_required to your Auth0 Resource Server identifier, and declare at least one authorization claim such as scopes_required or roles_required. Reference the client_secret from a Kong vault rather than inlining it in YAML.

Why does Kong return 401 Unauthorized with a valid Auth0 token?▼

The most common cause is an issuer mismatch: Auth0's iss claim includes a trailing slash and Kong's issuers_allowed must match byte-for-byte. Other causes include a missing audience producing an opaque token, or the token being minted for a different API than audience_required expects.

Should I use Kong's jwt plugin or openid-connect plugin for Auth0 tokens?▼

Use the openid-connect plugin in almost all cases. It handles JWKS discovery, claim-driven authorization, consumer mapping, and upstream header injection natively, while the jwt plugin requires manual key management and lacks OIDC flows.

Does Auth0 support token introspection for JWT access tokens?▼

No, Auth0 does not implement RFC 7662 introspection for JWTs, only for opaque tokens. Kong should verify JWTs locally via JWKS signature verification using the cached keys from /.well-known/jwks.json, avoiding per-request calls to Auth0.

Can I manage Auth0 configuration with Kubernetes CRDs alongside Kong?▼

Yes, the alethic/auth0-operator reconciles Auth0 Tenant, Client, ClientGrant, ResourceServer, and Connection CRDs under kubernetes.auth0.com/v1. It pairs with Kong Gateway Operator so Auth0 and Kong manifests are reviewed and rolled forward together in one GitOps repo.

When should I not use this Kong and Auth0 edge pattern?▼

Do not use it for Auth0 standalone integrations where the backend SDK talks to Auth0 directly with no gateway in the path, or for non-Kong gateways like Envoy or AWS API Gateway. It also does not cover workforce SSO into developer tools.

Related Skills

Explore More Software Engineering Skills→
auth0auth0
40

auth0-cli

Manage Auth0 tenant resources and APIs through the Auth0 CLI.

Official
Advanced
helpful-bitshelpful-bits

plantocode-live-e2e

Runs PlanToCode desktop end-to-end tests validating Auth0 JWT, Codex auth-file, and refresh tokens while capturing failure artifacts and logs for debugging.

Official
Advanced
lapc506lapc506
4

API Gateway & Rate Limiting

Implement API Gateway solutions with Kong and Nginx rate limiting.

Community
Advanced
moonmingmoonming
1

a6-plugin-openid-connect

Configure the Apache APISIX openid-connect plugin for OIDC authentication and authorization.

Community
Advanced