Custom Kong Plugins in Lua
When a bundled Kong plugin does not fit, we write the one that does — in Lua on OpenResty, packaged, tested and handed over with the pipeline that ships it.
What We Build
Plugins we have written for client gateways — each one a small, testable unit of Lua.
Request & Response Transformation
rewrite headers, paths, query strings and bodies on the way in and on the way out.
REST to SOAP
expose a SOAP backend as a REST API: the plugin builds the envelope, calls the service and maps the reply back.
JSON to XML
convert payloads between JSON and XML so old and new systems can talk.
Token Introspection
check an incoming token against the authorization server (RFC 7662) before the request reaches the upstream.
Caching
keep results in cache so repeated calls skip the round trip.
Queue-Based Batching
queue work off the request path and send it on in batches, so it does not slow the API.
Cross-Version Compatibility
one plugin that runs on Kong releases both before and after 3.3, so an upgrade does not force a rewrite.
How We Deliver
A plugin is only useful if your team can build, deploy and test it without us.
- Docker custom images. Kong images with the plugins baked in, so every environment runs the same build.
- luarocks packaging. each plugin ships as a rock with its rockspec, installed the standard Kong way.
- Scripted deploy and tests. deployment and tests run from scripts, ready to drop into your pipeline.
What Clients Say About Our Kong Work
In their words, unedited.
Nitin Aravind BirurAI Researcher, Enkrypt AIIntegrAuth brings genuinely impressive expertise in Kong Gateway and system/architecture design for DevOps infrastructure. They think through problems critically instead of just applying quick fixes, and it shows in the quality of their recommendations.
Communication is consistently great throughout a project. They keep you in the loop, explain trade-offs clearly, and are accommodating whenever requirements shift. Delivery is on time, every time, which isn't something you can say about every vendor.
Beyond the technical skills, they're just great to work with, patient, responsive, and easy to collaborate with. Highly recommend IntegrAuth for Kong Gateway or infra architecture expertise.
Divyanshu KumarFounding AI Research Engineer, Enkrypt AII've been working with IntegrAuth for almost two and a half years, and they've been a great team to work with. They're technically strong and have deep expertise across Kong Gateway, security, authentication and authorization, and audit trails. Their experience with Kong Gateways, OpenSearch and Elasticsearch has also been really valuable for us.
What I've particularly liked is how quickly they understand a problem and come up with practical solutions. They're professional, responsive, and get things done without unnecessary back and forth. Having worked closely with them for this long, I'd definitely recommend the IntegrAuth team.
Ritesh SonawaneEx-DevOps SRE, CloudRaft · now at COVARATECHI've been working with IntegrAuth for almost a year now, and honestly, they've been great to work with. Their team really knows their stuff when it comes to Kong Gateway, security, authentication and authorization, and audit trails. They also have strong experience with tools like OpenSearch and Elasticsearch, which has been really useful for us. One thing I especially appreciated was their migration planning — they helped us figure out how to move from our legacy system to a more modern setup without taking unnecessary risks, and their recommendations around the authentication system gave us a lot more confidence in the new architecture. They're technically strong, practical, and actually take the time to understand the problem before suggesting a solution. Would definitely recommend them.
Learn It Free First
We teach what we practice — free, no sign-up.
The API Gateway
Enforcement at the front door — what belongs in the gateway and what doesn't
IntegrAuth Academy · freeGateway JWT Lint
Lint an API-gateway JWT-validation policy (Kong / Azure APIM / cloud)
gwjwtlint.integrauth.comRelated deep dives: API Security · MCP Security · AI Agent Security
Need a Kong Plugin Built?
Tell us what the gateway has to do and which Kong version you run.
Get in touch