# Exclude authentication from one route of a service

**URL:** <https://discuss.konghq.com/t/exclude-authentication-from-one-route-of-a-service/3188>\
**Category:** Questions\
**Created:** [April 3, 2019, 3:29pm UTC](https://discuss.konghq.com/t/exclude-authentication-from-one-route-of-a-service/3188 "2019-04-03T15:29:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![davideagle](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/davideagle/32/785_2.png) [@davideagle](https://discuss.konghq.com/u/davideagle)\
**Post date:** [April 3, 2019, 3:29pm UTC](https://discuss.konghq.com/t/exclude-authentication-from-one-route-of-a-service/3188/1 "2019-04-03T15:29:13Z")

</div>

I have a service with a key-auth attached on the service level, however I’d like to exclude a route from requiring authentication. Is that possible to exclude one route from authentication from a service while keeping the auth plugin enabled on the service level or do I need to turn to route based authentication?

/api/service [key-auth]  
/api/service/{\*} [key-auth]  
/api/service/openurl [no-auth]

kong v1.1.0  
kong-ingress-controller v0.3.0

---

<div class="post-metadata">

**Author:** ![Raimon\_Grau](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/raimon_grau/32/854_2.png) [@Raimon\_Grau](https://discuss.konghq.com/u/Raimon_Grau)\
**Post date:** [April 3, 2019, 7:25pm UTC](https://discuss.konghq.com/t/exclude-authentication-from-one-route-of-a-service/3188/2 "2019-04-03T19:25:39Z")

</div>

If a plugin is applied to a service, it will run for all routes of the service, but if there’s another key-auth plugin attached to the route, only the most specific plugin will run (in this case, the one attached to the route)

It’s a bit hacky, but you could configure key-auth on that route only with an anonymous consumer. Check `config.anonymous` on [key-auth plugin](https://docs.konghq.com/hub/kong-inc/key-auth/)

---

<div class="post-metadata">

**Author:** ![davideagle](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/davideagle/32/785_2.png) [@davideagle](https://discuss.konghq.com/u/davideagle)\
**Post date:** [April 4, 2019, 3:49pm UTC](https://discuss.konghq.com/t/exclude-authentication-from-one-route-of-a-service/3188/3 "2019-04-04T15:49:03Z")

</div>

Thank you very much for putting me on the right track for this, I managed to do this by issuing

```
curl -i -X PATCH \
--url http://kong:8001/plugins/77b29ca5-4092-499e-ba96-04983ccd877d \
--data "config.anonymous=c97b40c3-56cf-11e9-8ba9-026db3b4995a"

```

How ever I’m using kong-ingress-controller and I’m unsure how to link the key-auth plugin to the consumer using the kubernetes manifests, the following does not work, and I suspect I’d be able to somehow link to the consumer without using the uuid in the kubernetes manifest

```
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: wallet-openapi-key-auth
  namespace: default 
plugin: key-auth
config:
   anonymous: c97b40c3-56cf-11e9-8ba9-026db3b4995a
```

---

<div class="post-metadata">

**Author:** ![davideagle](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/davideagle/32/785_2.png) [@davideagle](https://discuss.konghq.com/u/davideagle)\
**Post date:** [April 4, 2019, 4:18pm UTC](https://discuss.konghq.com/t/exclude-authentication-from-one-route-of-a-service/3188/4 "2019-04-04T16:18:06Z")

</div>

update: I managed to get the kubernetes manifest working as displayed a bow how ever using UUIDs in the manifest is not Ideal

---

<div class="post-metadata">

**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\
**Post date:** [April 5, 2019, 6:00am UTC](https://discuss.konghq.com/t/exclude-authentication-from-one-route-of-a-service/3188/5 "2019-04-05T06:00:29Z")

</div>

@davideagle Indeed, please open a [Github Issue](http://github.com/kong/kubernetes-ingress-controller) for this, thank you!