Gateway Orchestration

Gateway Orchestration is Aforo's unified credential and consumer lifecycle management layer. When a customer subscribes, Aforo automatically provisions their API credentials across every connected gateway — Kong, Apigee, AWS, Azure, and MuleSoft — in a single atomic operation.

What Gets Provisioned

When a subscription is created with gateway orchestration enabled:

Consumer Identity — A gateway-level consumer entity is created for the customer in each connected gateway
Application — An application container is created under the consumer
Credentials — API keys or client credentials are generated and bound to the subscription
Product Scope — The customer's subscribed products are whitelisted on their credentials

All of this happens automatically, within seconds of subscription creation.

Provisioning Modes

Mode	Description
`AFORO_PROVIDED`	Aforo generates the credential and pushes it to all gateways
`GATEWAY_GENERATED`	Each gateway generates its own credential; Aforo collects and stores the results

Consumer Identity Model

Aforo Customer
  └── Gateway Consumer (one per gateway)
        └── Gateway App (one per subscription)
              └── Credentials (keys / client creds)
                    └── Product Scope (which APIs accessible)

Credential Lifecycle

Suspend / Reactivate

Temporarily block access without revoking. Useful for payment failure enforcement:

Rotate

Rotate credentials with a grace period — both old and new credentials are valid for 300 seconds, preventing service disruption during rotation:

Revoke

Permanent, immediate revocation across all gateways:

Circuit Breaker

Each gateway integration has a circuit breaker to prevent cascade failures:

CLOSED — Normal operation
OPEN — 5 consecutive failures; no requests sent to gateway for 300 seconds
HALF-OPEN — Test request sent; success → CLOSED, failure → OPEN again

View and reset circuit breakers:

Product Scope

Control which of a customer's subscribed products they can access via a specific credential:

Async Secondary Provisioning

When provisioning to multiple gateways, Aforo uses a primary gateway + asynchronous secondary pattern:

Primary gateway — provisioned synchronously (immediate)
Secondary gateways — queued and processed asynchronously

This means a failure in a secondary gateway does not block the subscription from activating.

Operations Dashboard

The Operations tab provides:

Sync Provisioning — Force-sync all credentials to all gateways now
Emergency Enforcement — Immediately suspend all credentials for a specific customer
Audit Log — Every provisioning action with outcome, duration, and error details
Daily Stats — Success rates, failure rates, P95 provisioning latency