AWS API Gateway

Amazon API Gateway is a managed service for creating, publishing, and protecting APIs. An API is a set of addresses that apps call to request data or trigger actions. API Gateway sits in front of your backend and handles traffic, security, and limits.

Think of a hotel reception desk. Guests never walk into the kitchen or the laundry room. They ask the receptionist, who checks their identity and passes the request to the right department. API Gateway plays the receptionist, and your Lambda functions, servers, or databases play the departments.

What Problem It Solves

Mobile apps and websites need a clean, secure entry point to backend code. Building that entry point from scratch means writing code for authentication, throttling, logging, and versioning. API Gateway provides all of these features out of the box.

Mobile App ---+
              |
Website ------+--> API Gateway --> Lambda Function --> DynamoDB
              |
Partner App --+

Types of APIs

  • REST APIs offer the full feature set, including API keys, usage plans, request validation, and caching.
  • HTTP APIs offer a simpler, lower-cost, lower-latency option for most modern projects.
  • WebSocket APIs keep a two-way connection open for chat apps, live dashboards, and games.

Choosing a Type

Start with an HTTP API when you need a basic front door for Lambda or a web service. Choose a REST API when you need advanced controls such as usage plans or built-in caching. Choose a WebSocket API when the server must push messages to users without waiting for a request.

Core Building Blocks

  • Resource: a path such as /orders or /users.
  • Method: an action on the path, such as GET, POST, PUT, or DELETE.
  • Integration: the backend that receives the request, such as a Lambda function.
  • Stage: a named version of the API, such as dev, test, or prod.

How a Request Travels

Client sends:  GET /orders/42
        |
        v
+-------------------------+
| API Gateway             |
| 1. Check permissions    |
| 2. Apply rate limits    |
| 3. Match route          |
| 4. Call integration     |
+-------------------------+
        |
        v
Lambda reads order 42 from DynamoDB
        |
        v
Response returns to the client

Controlling Who Calls Your API

  • IAM authorization lets AWS identities sign requests.
  • Amazon Cognito user pools validate users who sign in to your app.
  • Lambda authorizers run custom code that checks tokens from any identity provider.
  • API keys identify client apps for tracking and plans, but they do not replace real authentication.

Throttling and Usage Plans

Throttling protects your backend from floods of requests. You set a steady rate and a burst limit. Requests above the limit receive an error response instead of overwhelming the servers.

Usage plans in REST APIs let you offer different access levels. A free tier of your service might allow a thousand calls a day, and a paid tier might allow a hundred thousand.

Stages and Deployments

Developers test changes in a dev stage before releasing them. Each stage has its own address and settings.

https://abc123.execute-api.us-east-1.amazonaws.com/dev
https://abc123.execute-api.us-east-1.amazonaws.com/prod

Stage variables and custom domains give you tidy addresses such as api.yourcompany.com.

Caching and Monitoring

REST APIs can cache responses for a set time. A repeated request returns the stored answer without waking the backend. CloudWatch collects metrics such as request count, latency, and error rates. Access logs record who called which route and when.

Example: A Simple To-Do Service

  1. Create a DynamoDB table named todos.
  2. Write a Lambda function that reads and saves items.
  3. Create an HTTP API in API Gateway.
  4. Add routes: GET /todos and POST /todos.
  5. Connect both routes to the Lambda function.
  6. Deploy the API and test it with a browser or a tool like curl.
curl https://abc123.execute-api.us-east-1.amazonaws.com/todos

Cross-Origin Requests (CORS)

Browsers block a web page from calling an API on a different domain unless the API allows it. Enable CORS in API Gateway and list the website addresses you trust. A missing CORS setting is the most common cause of mysterious browser errors during first projects.

Best Practices

  • Require authentication on every route that touches private data.
  • Set throttling limits that match your backend capacity.
  • Turn on logging and review error rates regularly.
  • Use separate stages for development and production.
  • Validate input so bad requests never reach your code.

API Gateway turns scattered backend code into a managed, secure, and observable service that scales with demand.

Previous lesson
Back to course
Next lesson