# How best to secure api from requests that aren't routed through Kong

**URL:** <https://discuss.konghq.com/t/how-best-to-secure-api-from-requests-that-arent-routed-through-kong/489>\
**Category:** Questions\
**Created:** [February 5, 2018, 11:51am UTC](https://discuss.konghq.com/t/how-best-to-secure-api-from-requests-that-arent-routed-through-kong/489 "2018-02-05T11:51:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mcintyre321](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/mcintyre321/32/178_2.png) [@mcintyre321](https://discuss.konghq.com/u/mcintyre321)\
**Post date:** [February 5, 2018, 11:51am UTC](https://discuss.konghq.com/t/how-best-to-secure-api-from-requests-that-arent-routed-through-kong/489/1 "2018-02-05T11:51:02Z")

</div>

Hi, my organisation is planning to use Kong to secure an API. We are considering approached for securing the API in situations where the requests are sent to the API without going through Kong (e.g. if the API is accessed by IP).

Is there some way to tell if a request has come via Kong, that can be used by the web server to allow traffic through?

I understand I can check the IP address, but maybe there’s some way to get a signed token, in case I don’t know the IP?

---

<div class="post-metadata">

**Author:** ![ioneyed](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/ioneyed/32/332_2.png) [@ioneyed](https://discuss.konghq.com/u/ioneyed)\
**Post date:** [February 14, 2018, 12:57pm UTC](https://discuss.konghq.com/t/how-best-to-secure-api-from-requests-that-arent-routed-through-kong/489/2 "2018-02-14T12:57:37Z")

</div>

I use the “Request Transformation” Plugin to add a header to the upstream request. I am using a rudimentary method of a UUID per API so each one is different however there are other plugins such as the `jwt-upstream` that someone has written to handle it in a more cryptographic way.

---

<div class="post-metadata">

**Author:** ![Ankur\_Goyal](https://avatars.discourse-cdn.com/v4/letter/a/e79b87/32.png) [@Ankur\_Goyal](https://discuss.konghq.com/u/Ankur_Goyal)\
**Post date:** [September 18, 2018, 2:50pm UTC](https://discuss.konghq.com/t/how-best-to-secure-api-from-requests-that-arent-routed-through-kong/489/3 "2018-09-18T14:50:24Z")

</div>

@ioneyed, I wish to understand what did you mean u adding UUID to upstream header-what upstream API endpoint would do in this case to ensure request is coming via KONG only?