Sign in →
Gateways1 min read

Gateway Integrations Overview

Aforo supports five enterprise API gateways via native plugin mechanisms. Zero application code changes. Drop-in metering across your entire gateway estate.

Updated 2026-06-15Suggest edits
Docs Gateways Overview

Supported Gateways#

Aforo ships production-grade integrations for all five major enterprise API gateways. Each integration uses the gateway's native extension mechanism — no sidecars, no service mesh changes, no infrastructure modifications. The plugin installs in minutes and metering begins immediately.

Plugin Architecture#

Every gateway integration follows the same two-phase architecture: a synchronous entitlement check in the request path, and an asynchronous metering event in the response path. The gateway's native extension mechanism is the execution container — Aforo provides the logic.

unified-gateway-plugin-architecture.flowLIVE
INBOUND
API Request
client → gateway
TLS termination. Route matching. Plugin chain invoked.
0ms
ENFORCE
Entitlement
pre-request phase
Redis edge cache lookup. Tenant + quota + margin check.
<5ms
PROXY
Upstream
your backend
Request forwarded to origin. Response streamed back.
passthrough
CAPTURE
Metering
post-response async
Event extracted from response context. Never blocks client.
0ms added
BUFFER
Batch Flush
100 events / 5s
lz4 compressed batch. Disk spillover on ingest failure.
5s window
INGEST
Aforo
ingest.aforo.ai
HTTPS POST with idempotency key. Retry on 5xx.
<60ms
unified plugin architecture · all 5 gateways · same two-phase model// p95 < 5ms

How Each Gateway Implements the Model

GatewayMechanismRuntime Detail
KongLua Pluginaccess phase (entitlement) + log_by phase (metering). Lua coroutine — no thread blocking.
ApigeeShared FlowPreProxyFlowHook (enforce) + PostProxyFlowHook (meter). JavaScript callout for event push.
AWS API GWLambda + CWLambda authorizer (enforce) + CloudWatch Logs subscription filter (meter). SigV4 auth.
Azure APIMPolicy FragmentInbound policy (enforce) + outbound policy (meter). C# expression eval. Named Values for secrets.
MuleSoftCustom PolicyAPI Manager policy chain. DataWeave extraction. Anypoint Exchange distribution.
INFO
All five plugins share the same ingest protocol: a compressed HTTPS POST to ingest.aforo.ai/v1/ingest with an idempotency key derived from the request correlation ID. Events are deduplicated server-side — safe to retry on failure.

Choosing Your Integration#

Most teams run a single gateway. Pick the guide that matches your stack and follow the step-by-step setup. If you run multiple gateways — common in enterprise organizations that have run through acquisitions or multi-cloud mandates — see the Multi-Gateway section below.

PRO TIP
Not sure which gateway you have? Check your team's infrastructure-as-code repo for kong.yml, apigee, or CloudFormation / Terraform references. Aforo Support can also review your architecture diagram and recommend the right integration path.

Capability Matrix#

All five gateways support the full Aforo feature set. The table below shows how each capability maps to a gateway-specific implementation:

CapabilityKongApigeeAWSAzureMuleSoft
Usage Metering✓ log_by✓ PostProxy✓ CW Logs✓ Outbound✓ Policy
Entitlement Check✓ access✓ PreProxy✓ Authorizer✓ Inbound✓ Before
Margin Guard L1-L3✓ native✓ RaiseFault✓ Lambda✓ SetHeader✓ Policy
Product Discovery✓ auto✓ via API✓ via API✓ via API✓ via API
Monetized Tagging✓ service tags✓ attributes✓ tags✓ tags✓ tags
Gateway Restore✓ full✓ full✓ full✓ full✓ full
Config Capture✓ routes+plugins✓ product detail✓ resource tree✓ API + ops✓ asset meta
INFO
All capabilities ship enabled by default. Individual capabilities can be disabled per-integration via the Aforo Admin Panel under Integrations → select gateway → Feature Flags. This is useful when incrementally rolling out metering across a large existing estate.

Multi-Gateway Deployments#

Enterprise organizations often run multiple gateways simultaneously — a legacy Apigee estate alongside new Kong clusters, or AWS API Gateway for serverless workloads beside Azure APIM for enterprise B2B APIs. Aforo is designed for this.

multi-gateway-topology.txt
Tenant A subscription
  ├── Kong (Kubernetes cluster) ──────► Aforo Ingest ──► Single billing record
  │   └── aforo-metering plugin                    ▲
  ├── AWS API Gateway (serverless) ──► Lambda ─────┘
  │   └── CloudWatch Logs subscription             ▲
  └── Azure APIM (enterprise B2B) ─► Policy ───────┘
      └── Outbound policy fragment

All three gateways write to the SAME tenant billing context.
Aforo deduplicates, rates, and routes to a single invoice.

Multi-Gateway Setup Steps

1
Create an integration per gateway
In Aforo Admin Panel → Integrations, add each gateway as a separate integration entry. Each gets its own API key and ingest routing config.
2
Deploy the plugin to each gateway
Follow the individual gateway guides. Each plugin is independent — deploy and verify one at a time.
3
Map products across gateways
Use the Product Catalog to link the same Aforo Product to multiple gateway integrations. Usage from all gateways accrues to the same product meter.
4
Verify unified billing
After all gateways are live, use the Event Log to confirm events from each gateway are arriving under the same tenant context. Run a test bill cycle.
WARNING
When running multiple gateways, ensure all plugins use the same tenant header name (X-Tenant-Id) and that your API clients send it consistently. Aforo uses this header to correlate usage across gateways into a single billing record. Mismatched headers cause split billing contexts.