An NGINX-based gateway that pulls its routes from etcd
Apache APISIX is an API gateway. It sits in front of a set of services and handles routing, caller authentication, rate limiting, and metrics and traces. It runs on NGINX and OpenResty, with plugins written in Lua. Configuration lives in etcd, so a route changed through the Admin API takes effect without a restart. The same engine handles traffic between services as well as inbound traffic, and also runs as a Kubernetes ingress or as a gateway in front of LLM providers.
Hot-loaded plugins and proxying beyond HTTP
- Live reconfiguration: routes, upstreams, TLS certificates and plugins change without a restart, and operations can be rolled back.
- Routing on any built-in NGINX variable, such as a cookie or a query argument, with operators like
{"arg_age", ">", 24}and match priorities. Thetraffic-splitplugin sends a share of the traffic to another upstream by weight or by condition. - Protocols other than HTTP: TCP and UDP, gRPC (with transcoding from HTTP/JSON), WebSocket, Dubbo, HTTP/3 over QUIC, and MQTT 3.1 or 5.0 load-balanced by
client_id. - 100+ plugins by the project's own count: JWT, OpenID Connect, authorization handed off to Keycloak, rate limits, CORS, CSRF. For observability, Prometheus metrics, OpenTelemetry or SkyWalking traces, and logs shipped to Kafka, Elasticsearch or Loki.
- LLM traffic:
ai-proxy-multispreads calls across OpenAI, Anthropic, Gemini or any OpenAI-compatible API, with retries and fallbacks, whileai-rate-limitingcaps token usage. Since 3.19.0,openapi-to-mcpreads an HTTP API's OpenAPI document and turns each operation into an MCP tool. - Built-in web UI since 3.13.0, on by default and served from the Admin API port (
:9180/ui/).
Running etcd, and breaking changes in every minor release
Outside standalone mode, every node depends on etcd. The installation guide keeps the etcd bundled with the Helm chart for development and testing; production calls for an external, version-pinned etcd with authentication, TLS and backups. Standalone mode drops etcd and loads a full YAML or JSON configuration from disk, checked for changes every second, on a node in the data-plane role. Its API-driven variant is built for the Ingress Controller, and the docs warn against using it directly without understanding its internals.
Linux is the only platform the guide names for production. The same guide asks operators to replace the example Admin API key and restrict allow_admin, and points out that the rate-limiting plugins do not protect the Admin API.
The project credits Kong and aims at microservices. The README names Kong and Orange as inspirations. It contrasts APISIX with "traditional" API gateways on dynamic routing and hot-loaded plugins, which it calls especially suitable for API management in a microservice architecture.
Go, Java and Python plugins run in a separate process that talks to APISIX over local RPC. The Go runner's last release is v0.5.0, from 7 November 2022, and the Python runner's is 0.2.0, from 4 March 2022; the Java runner is at 0.6.0, from 12 April 2025. The README calls the WebAssembly route experimental.
Version 3.19.0 came out on 28 September 2026, the fifth minor release this year. Its changelog flags eleven backward-incompatible changes, after fourteen in 3.18.0 and eleven in 3.17.0. In 3.19.0, upstream.tls.verify now applies to https and grpcs upstreams, so an upstream already set to verify: true starts rejecting any certificate it cannot validate. The download page names no LTS release, and the last LTS maintenance release in the changelog is 3.2.1.