By default, if no listeners are specified, the Kafka Connect REST server runs on port 8083 using HTTP. Anyone who can reach that port can use an API that manages connectors, so bind it to a private interface, use HTTPS, restrict the network path, and put any further access control in front of it.
What the API is for
The Kafka documentation says Kafka Connect is intended to run as a service and provides a REST API for managing connectors, available in both standalone and distributed mode. You can start a worker with no connector configuration files and create connectors at runtime through the REST API. That is convenient for operations. It also means the API is a control plane: it can create a connector that reads from or writes to systems the Connect worker can reach, using credentials the worker holds.
The user guide section on the REST listener covers protocol, host, port and TLS settings. It does not describe a login step there, so plan on network controls and TLS, plus any proxy or extension your platform provides. Check your own version's documentation for what else it offers.
Configure the listener
The REST server is set with the listeners option, a list in the form protocol, host and port. Supported protocols are http and https. The documentation's example is a localhost http listener and a localhost https listener.
When you use HTTPS, you must include the SSL configuration. By default it uses the ssl settings from the worker. If you want different settings for the REST API than for the broker connection, prefix them with listeners.https, and then only the prefixed options are used and the unprefixed ssl options are ignored. That detail matters: a team that sets the prefix with a partial list of options may end up with a different configuration than they expect.
What to review
| Question | Why it matters |
|---|---|
| Which interface is it bound to | Binding to all addresses exposes it to every network the host sits on |
| Is HTTP still enabled | Request bodies can include connector settings, which may include credentials |
| Who can route to 8083 | Network rules are your main access control |
| What can the worker reach | A new connector inherits the worker's network reach |
Steps
- Find every Connect worker, including those in development clusters and those started by data teams.
- Read the listeners setting on each. If it is absent, assume HTTP on 8083.
- Bind to a private interface and add an HTTPS listener with certificates.
- Remove the HTTP listener once clients have moved.
- Restrict port 8083 to the operators and automation that manage connectors.
- Review which secrets are in connector settings. Use the secret handling approach your platform supports, and avoid pasting passwords into request bodies and shell history.
- Log and review connector creation and changes, so an unexpected new connector gets noticed.
Why this matters for supply chain risk
Connect loads plugins: connectors, converters and transformations are loaded from the paths listed in the worker's plugin.path setting. A connector is third party code running with the worker's privileges. An open API that can add connectors, together with plugins you have not reviewed, can mean unreviewed code touching your data. Keep an inventory of installed plugins and their versions, and update them like any other dependency.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how an API scan reports unauthenticated or unencrypted endpoints, and think about how your own admin APIs would look to it.
Safeguard's asset discovery helps find services like Connect workers, and the free scan covers your dependencies, including connector plugins you build from source.
Quick check
Is the Connect REST API HTTPS by default?
No. The documentation says that with no listeners specified it runs on port 8083 using HTTP.
Can I use different certificates for the REST API than for the broker connection?
Yes. Prefix the SSL options with listeners.https, and only the prefixed options are then used for the REST API.
Sources
Last reviewed: 19 October 2026.
