Plans

A plan defines the access policy for an API Product: the rate limit, security requirement, quota, approval mode, and SLA a consumer gets when they subscribe.

Plans are no longer managed from a separate catalog-level screen. Each API Product carries its own plan, configured and viewed from that product's own Details tab.

View or Edit a Plan

1. Navigate to API Products → [product] → Details.
2. Review the Plan section:
   • Rate Limit: a capacity and unit (B/s, KB/s, MB/s, GB/s), or Unlimited.
   • Security: the authentication a subscriber must present (see Security Options).
   • Quota: the usage cap applied to subscribers, or Unlimited.
   • Approval: Automatic or manual approval for new subscriptions.
   • SLA: an optional service-level commitment.
3. Edit the plan fields and save.

Security Options

Option	What the subscriber presents
API Key (SASL/PLAIN over TLS)	The generated key and secret as SASL/PLAIN credentials over TLS.
API Key (SASL/SCRAM-256)	The same generated credentials over SASL/SCRAM-SHA-256.
mTLS (client certificates)	A client certificate signed by a certificate authority trusted by the environment.
OAuth 2.0	A token issued by an authorization server.
None	Nothing: the product is served unauthenticated.

A product's plan security determines what a consumer receives when they subscribe. See Subscriptions for the credentials each option produces.

mTLS Plans

An mTLS plan authenticates the client by certificate alone: no API key is issued and no SASL handshake takes place. Selecting mTLS (client certificates) requires a Certificate Authority, chosen from the CAs registered on the Gateway Group's environment. Any certificate signed by that CA is accepted, and its subscription's rate limit is the one on this plan.

Register the CA first, from Platform Settings → Environments → [environment] → Security; see Certificate Authorities.

Warning

All plans on one API Product must use the same authentication method. A product cannot mix an mTLS plan with an API Key plan; the request is rejected. A product created through New API Product starts with a single Default plan, so switching a product to mTLS means editing that plan rather than adding a second one.

Note

OAuth 2.0 is accepted by the API and shown in the picker, but the Gateway configuration for it is not generated yet, so an OAuth plan does not enforce a token today. Use API Key or mTLS.

Next Steps

• API Products covers the rest of a product's Details tab, alongside its plan.
• Subscriptions covers how a consumer subscribes to a product under its plan.