1. Home
  2. Red Hat Interactive Learning Portal
  3. Unlock self-service API credentials on Connectivity Link

Unlock self-service API credentials on Connectivity Link

Learning path | 5 resources | 2 hrs and 45 mins | Published on September 18, 2026
Maximiliano Pizarro

Understand how to set up a hub-only Connectivity Link stack, then let developers mint API keys and OIDC client credentials from Red Hat Developer Hub, without ticket back and forth.

Access Red Hat Developer Hub

  1. Overview: Unlock self-service API credentials on Connectivity Link
  2. Install the hub-only stack with multi-cloud GitOps Page | 45 mins
  3. Provision self-service API keys for external REST APIs Page | 40 mins
  4. Protect AI inference APIs with OpenID Connect AuthPolicy Page | 50 mins
  5. Use the Swagger Try It Out feature for Connectivity Link with EnvoyFilter Page | 30 mins

Overview: Unlock self-service API credentials on Connectivity Link

A Red Hat Connectivity icon inside a red hexagon on a black background

Platform teams often need to secure two different Application Programming Interface (API) consumers at the same time: programmatic clients that call third-party software-as-a-service (SaaS) or existing REST endpoints with API keys, and machine-to-machine callers that authenticate to AI inference services with OpenID Connect (OIDC) Bearer tokens. Without a unified gateway policy plane, each API team reinvents authentication, rate limits, and developer onboarding.

This learning path solves that problem on a single Red Hat OpenShift hub cluster. The multi-cloud GitOps validated pattern assembles the solution. You apply a hub-only Pattern custom resource (CR) that points at the AI Computer Vision pattern repository, which deploys Red Hat Connectivity Link, Red Hat Developer Hub, Red Hat build of Keycloak, and the demo workloads together through GitOps. Then you walk through two self-service credential flows:

  1. API keys for an external REST Countries API exposed on the workshop-apis gateway.
  2. OIDC client credentials for the Computer Vision inference API (neuroface-cv) on the neuroface-gateway.

By the end, developers request keys or OIDC clients from Developer Hub, and Kuadrant AuthPolicy enforces authentication and tiered rate limits at the Gateway, without separate tickets to platform engineering.

Prerequisites:

  • Experience with Kubernetes and OpenShift, specifically the Gateway API, Operators, and oc workflows. 
  • An OpenShift cluster sized as a hub-only CPU, that is a single cluster, no spokes, and no GPU required. On Amazon Web Services (AWS), a validated starting point is 3× m6a.2xlarge control plane nodes and 4–5× m6a.4xlarge worker nodes. On other clouds, use comparable vCPU and memory. See Cluster sizing.
  • Access to the OpenShift web console with the cluster-admin role. 
  • A workstation with the oc binary installed.
  • A Red Hat pull secret and registry access as required by the pattern.
  • Access to the AI Computer Vision GitHub repository.

In this learning path, you will:

  • Install the Validated Patterns Operator and apply the hub-only Pattern CR that uses multi-cloud GitOps to assemble the stack.
  • Verify the components multi-cloud GitOps deploys on a single hub cluster.
  • Expose an external REST API with Gateway API, AuthPolicy (APIKEY), and PlanPolicy.
  • Provision API keys through a Developer Hub software template and validate with Swagger UI and curl.
  • Protect an AI inference API with AuthPolicy JSON Web Token (JWT) validation and OIDC self-service from Developer Hub.
  • Revoke OIDC clients and confirm gateway enforcement with curl and the Swagger Try it out feature.