> ## Documentation Index
> Fetch the complete documentation index at: https://docs.conduktor.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Kafka interceptors — Gateway plugins for security and governance

> Conduktor Gateway interceptors enforce Kafka encryption, data quality, access control, and traffic control without changing client code.

Interceptors are <Tooltip tip="A Kafka proxy that deploys extensible plugins for encryption, filtering, and data processing.">Gateway</Tooltip> plugins that intercept and modify Kafka requests and responses in real time.

They help enforce policies, protect data, and add functionality without changing your applications or Kafka configuration.

<Info>
  **Learn more:** [Conduktor Gateway](https://www.conduktor.io/gateway) How Gateway and its Interceptors add encryption, governance, and traffic control to Kafka.
</Info>

## What Interceptors do

Interceptors can:

* Encrypt and decrypt message fields or entire payloads
* Block or skip records that don't meet data quality rules
* Enforce producer settings like acks or compression
* Control topic creation parameters like replication factor or partition count
* Transform message content or headers

## How they work

Each Interceptor has a `priority` field — a number where lowest runs first. The same numeric order applies on both produce and consume; ordering doesn't reverse between directions. Priorities are typically spaced apart (for example, `100`, `200`, `300`) so you can insert Interceptors between existing ones without renumbering.

Interceptors fire on different paths depending on what they do:

* **Produce-only** — for example, `EncryptPlugin` runs as records flow from client to broker.
* **Consume-only** — for example, `DecryptPlugin` runs as records flow from broker to client.
* **Both paths** — for example, `LargeMessageHandlingPlugin` runs as records flow from client to broker and broker to client.

For example, an `EncryptPlugin`, `LargeMessageHandlingPlugin`, and `DecryptPlugin` configured on the same topic share one priority order across both paths:

```yaml theme={null}
# Priority 100: encrypt on produce
apiVersion: gateway/v2
kind: Interceptor
metadata:
  name: myEncryptPlugin
  scope:
    vCluster: passthrough
spec:
  pluginClass: io.conduktor.gateway.interceptor.EncryptPlugin
  priority: 100
  config:
    topic: "topic.*"
    kmsConfig:
      vault:
        uri: http://vault:8200
        token: ${VAULT_TOKEN}
    recordValue:
      payload:
        keySecretId: vault-kms://vault:8200/transit/keys/payload-key
        algorithm: AES128_GCM
---
# Priority 200: offload large messages to cloud storage
apiVersion: gateway/v2
kind: Interceptor
metadata:
  name: myLargeMessageHandlingPlugin
  scope:
    vCluster: passthrough
spec:
  pluginClass: io.conduktor.gateway.interceptor.LargeMessageHandlingPlugin
  priority: 200
  config:
    topic: "topic.*"
    minimumSizeInBytes: 1024
    localDiskDirectory: myStorage/
    s3Config:
      bucketName: myBucketName
      uri: http://myexampleuri
      region: us-east-1
---
# Priority 300: decrypt on consume
apiVersion: gateway/v2
kind: Interceptor
metadata:
  name: myDecryptPlugin
  scope:
    vCluster: passthrough
spec:
  pluginClass: io.conduktor.gateway.interceptor.DecryptPlugin
  priority: 300
  config:
    topic: "topic.*"
    kmsConfig:
      vault:
        uri: http://vault:8200
        token: ${VAULT_TOKEN}
```

For why this ordering matters when offloading encrypted records to cloud storage, see [Combine with encryption](/guide/use-cases/manage-large-messages#combine-with-encryption).

Interceptors can also be:

* **Scoped** — apply to specific <Tooltip tip="A service account is a non-human identity used by Kafka clients to authenticate and perform actions on resources.">service accounts</Tooltip>, <Tooltip tip="A `GatewayGroup` — multiple Gateway service accounts grouped to share Interceptor scope.">groups</Tooltip> or <Tooltip tip="A logical representation of a Kafka cluster in Gateway.">Virtual Clusters</Tooltip>
* **Overridden** — more specific scopes take precedence over broader ones

Gateway applies Interceptors dynamically based on which client connects, so different teams can have different policies without separate clusters.

## Related resources

* [Interceptor reference](/guide/reference/interceptor-reference)
* [Configure data quality policies](/guide/use-cases/enforce-data-quality)
* [Apply traffic control policies](/guide/use-cases/apply-traffic-control-policies)