Integrations

Integrations connects Aforo to your external API gateways and platforms. Once connected, Aforo can discover existing products, sync pricing configuration, provision API credentials through your gateway, and monitor connection health.

Supported Gateways

Connection Methods

OAuth2 / SSO

For Kong, Apigee, Azure, and MuleSoft — authorize Aforo via OAuth to avoid storing long-lived credentials.

Manual / PAT

Paste your Personal Access Token or API key directly. Credentials are encrypted at rest with AES-256-GCM.

AWS CloudFormation

For AWS API Gateway — deploy a CloudFormation stack that creates an IAM role with the minimum permissions Aforo needs. No long-lived credentials.

Connecting a Gateway

1. Go to Governance → Integrations
2. Click + New Integration
3. Select your gateway provider
4. Choose OAuth2 (recommended) or Manual
5. Complete the authorization flow
6. Aforo tests the connection automatically

Product Sync

Once connected, Aforo can discover and import your existing API products from the gateway:

Discovery

GET /api/v1/products/discover?integrationId=int_abc123

Returns a list of products found in the gateway that aren't yet in Aforo.

Sync Preview (Terraform-style diff)

Before importing, preview what would change:

NEW:      PaymentAPI v3 (found at gateway, not in Aforo)
CHANGED:  TranslationAPI v2 (spec differs between gateway and Aforo)
UNCHANGED: AuthAPI v1 (identical)
STALE:    LegacyAPI v0 (in Aforo but not found at gateway)

Selective Import

Import only the products you want:

Drift Detection

Aforo monitors for config drift — when a gateway product's configuration diverges from Aforo's record. This happens when someone edits gateway config directly outside of Aforo.

When drift is detected:

1. Product monetizationStatus → STALE
2. Drift alert sent (email, Slack, webhook)
3. DriftAlertBanner appears in the product detail view

Fix drift by using Restore to Gateway to push Aforo's configuration back to the gateway.

Connection Health

Aforo checks each integration's health every 5 minutes:

• HEALTHY — Last test call succeeded
• DEGRADED — Intermittent failures (< 3 consecutive)
• ERROR — 3+ consecutive failures. Operator notified.

Circuit Breaker

Each integration has a circuit breaker that opens after 5 consecutive failures, preventing cascade failures from hitting an unresponsive gateway:

CLOSED → OPEN (5 failures) → HALF_OPEN (after 300s) → CLOSED (on success)

Credential Provisioning

Aforo can provision API credentials through your gateway when customers subscribe. This means Aforo creates and manages gateway-level consumers, applications, and API keys — not just Aforo-internal tokens.

API Key Modes