Integrations

Integrations connects Aforo to your external API gateways and platforms. Once connected, Aforo can discover existing products, sync pricing configuration, provision API credentials through your gateway, and monitor connection health.

Supported Gateways

These five ship as full adapters (discovery, credential provisioning, and config capture/restore). Individual capabilities — capture and the restore variants — vary by gateway; see Gateway Orchestration for the per-gateway lifecycle detail.

Connection Methods

OAuth2 / SSO

For Kong, Apigee, Azure, and MuleSoft — authorize Aforo via OAuth to avoid storing long-lived credentials.

Manual / PAT

Paste your Personal Access Token or API key directly. Credentials are encrypted at rest with AES-256-GCM.

AWS CloudFormation

For AWS API Gateway — deploy a CloudFormation stack that creates an IAM role with the minimum permissions Aforo needs. No long-lived credentials.

Connecting a Gateway

1. Go to Governance → Integrations
2. Click + New Integration
3. Select your gateway provider
4. Choose OAuth2 (recommended) or Manual
5. Complete the authorization flow
6. Aforo tests the connection automatically

Product Sync

Once connected, Aforo can discover and import your existing API products from the gateway:

Discovery

GET /api/v1/products/sync/{integrationId}/discover

Returns a list of products found in the gateway that aren't yet in Aforo.

Sync Preview (Terraform-style diff)

Before importing, preview what would change:

NEW:      PaymentAPI v3 (found at gateway, not in Aforo)
CHANGED:  TranslationAPI v2 (spec differs between gateway and Aforo)
UNCHANGED: AuthAPI v1 (identical)
STALE:    LegacyAPI v0 (in Aforo but not found at gateway)

Selective Import

Import only the products you want:

Drift Detection

Aforo monitors for config drift — when a gateway product's configuration diverges from Aforo's record. This happens when someone edits gateway config directly outside of Aforo.

When drift is detected:

1. The product's syncStatus → STALE
2. Drift alert sent (email, Slack, webhook)
3. A drift banner appears in the product detail view

To reconcile, use Restore to Gateway (in Gateway Orchestration) to push a previously-captured configuration snapshot back to the gateway.

Connection Health

Aforo checks each integration every 5 minutes and tracks two signals — a connection state and a health status.

Connection state (driven by the 5-minute check):

• CONNECTED — Last test call succeeded
• ERROR — 3+ consecutive failures. Operator notified.

Health status carries the finer read — HEALTHY, DEGRADED, DOWN, or UNKNOWN — so a single flaky check surfaces as DEGRADED without flipping the connection to ERROR.

Circuit Breaker

Each integration has a circuit breaker that opens after 5 consecutive failures, preventing cascade failures from hitting an unresponsive gateway:

CLOSED → OPEN (5 failures) → HALF_OPEN (after 120s) → CLOSED (on success)

Credential Provisioning

Aforo can provision API credentials through your gateway when customers subscribe. This means Aforo creates and manages gateway-level consumers, applications, and API keys — not just Aforo-internal tokens.

API Key Modes