Kong Gateway plugin
A native Lua plugin that verifies Presence at the gateway, mints browser-safe sessions, and fails closed.
Install and load
terminal
luarocks install kong-plugin-presenceexport KONG_PLUGINS=bundled,presencekong reloadProtect a checkout route
kong.yml
plugins: - name: presence route: checkout-route config: api_host: https://presence.decionis.com api_secret: "{vault://env/presence-api-secret}" tenant_id: tn_prod_998124 protected_routes: /api/v1/checkout/*Put the gate in front of the application
- 01
The Presence plugin runs in Kong's access phase. It strips client-supplied Presence headers, verifies a local ES256 proof or calls the Presence verification API, and forwards only a gateway-computed disposition.
- 02
Keep api_secret in a Kong Vault reference. Protected writes without usable verification return 403, and an unavailable verification authority returns 503 with no upstream request.
Verify the implementation
Public source, rockspec, tests, and the v1.0.1 release are reviewable.
GitHub source →Token cache keys are SHA-256 digests, negative verdicts are bounded, and an API failure is never converted into a pass.
Policy signals →
Current limits
- The plugin consumes Presence verdicts; it is an enforcement point, not a decision authority.
- The LuaRock and signed source release are public; Kong Plugin Hub review remains a separate partner-controlled publishing gate.
One next step
Continue with the executable path.