Cloud API Gateway — AWS API Gateway, Azure API Management & GCP Apigee Guide

In this tutorial, you'll learn about Cloud API Gateway. We cover key concepts, practical examples, and best practices to help you understand and apply this topic effectively.

Cloud API gateways manage, secure, and scale API traffic between clients and backend services — handling authentication, Rate Limiting, caching, and request transformation without custom code.

What You'll Learn

You'll learn how to deploy and configure API gateways across AWS, Azure, and GCP, including REST and WebSocket APIs, policy-based security, and developer portal setup for your APIs.

Why It Matters

Without an API Gateway, every backend must implement its own auth, throttling, and monitoring. A centralized gateway reduces code duplication, enforces consistent security policies, and provides analytics. DodaZIP uses API gateways to expose compression endpoints with per-customer Rate Limiting.

Real-World Use

A SaaS platform with 50 Microservices adds a new mobile client. Instead of updating every service, they configure the API Gateway to authenticate mobile tokens, transform requests to the internal format, and route to the correct service — in one place.

API Gateway Architecture

flowchart LR
  A[Mobile App] --> B[API Gateway]
  C[Web App] --> B
  D[IoT Device] --> B
  B --> E[Auth & Rate Limiting]
  E --> F[Request Transformation]
  F --> G[Backend Services]
  G --> H[Microservice 1]
  G --> I[Microservice 2]
  G --> J[Microservice 3]
  style B fill:#48f,color:#fff
  style G fill:#f90,color:#fff

AWS API Gateway

AWS API Gateway supports REST, HTTP, and WebSocket APIs with built-in Lambda integration.

# Create a REST API with Lambda proxy integration
aws apigateway create-rest-api --name "MyAPI" --description "Production API"

# Get the root resource ID
ROOT_ID=$(aws apigateway get-resources \
  --rest-api-id abc123 \
  --query "items[?path=='/'].id" \
  --output text)

# Create a resource under root
RESOURCE_ID=$(aws apigateway create-resource \
  --rest-api-id abc123 \
  --parent-id $ROOT_ID \
  --path-part "{proxy+}" \
  --query "id" \
  --output text)

# Deploy the API
aws apigateway create-deployment \
  --rest-api-id abc123 \
  --stage-name production

Azure API Management

Azure API Management provides a full API platform with policy-based governance.

az apim create \
  --name myapim-service \
  --resource-group my-rg \
  --location eastus \
  --publisher-name DodaTech \
  --publisher-email api@dodatech.com \
  --sku-name Developer

az apim api import \
  --resource-group my-rg \
  --service-name myapim-service \
  --path /v1 \
  --api-id orders-api \
  --display-name "Orders API" \
  --specification-format OpenApi \
  --specification-path ./openapi.json

GCP Apigee

Apigee provides enterprise-grade API management with advanced analytics.

# Create an Apigee organization and environment
gcloud apigee organizations create \
  --analytics-region us-central1 \
  --display-name "DodaTech API Platform"

gcloud apigee environments create \
  --name prod \
  --organization my-org \
  --display-name "Production"

# Deploy an API proxy
gcloud apigee apis create \
  --name orders-v1 \
  --organization my-org \
  --proxy-bundle ./orders-v1.zip

Common API Gateway Policies

Common Errors

1. Misconfigured CORS — Browser requests fail with opaque errors. Enable CORS on the gateway and preflight (OPTIONS) requests.
2. Overly permissive rate limits — Without throttling, a single client can overwhelm downstream services. Always set per-key and per-route limits.
3. Ignoring gateway timeouts — API Gateway enforces a 29-second timeout. Long-running operations should use async patterns with webhooks.
4. Hardcoding stage URLs in clients — Use custom domains and environment variables so stage changes do not break production clients.
5. Not using API Versioning — Without versioning, a breaking change affects all clients. Use path-based (/v1/, /v2/) or header-based versioning.

Practice Questions

1. What is the difference between REST API and HTTP API in AWS API Gateway? REST API offers more features (API keys, usage plans, WAF integration). HTTP API is simpler, cheaper, and faster but has fewer options.
2. How does Azure API Management handle API Versioning? Through URL-based versioning with set-backend-service policy, or header-based versioning with a versioning policy.
3. What is API-first development? Designing the API contract first (OpenAPI spec), then building the backend. API gateways validate requests against the contract automatically.
4. How do you secure API Gateway access? Use API keys, OAuth2/JWT, IP whitelisting, mutual TLS, or a combination. Always enforce HTTPS.
5. Challenge: Design an API Gateway architecture for a food delivery app with 10,000 orders/minute. Include Rate Limiting per restaurant, JWT auth for customers, and webhook support for order status updates.

Mini Project

Deploy a three-service API Gateway:

• Service A: product catalog (Lambda + DynamoDB)
• Service B: order processing (Azure Functions + Cosmos DB)
• Service C: payment webhook (Cloud Run + Firestore)
• Configure unified auth, Rate Limiting, and request logging across all three

FAQ

Built by the developers of Doda Browser, DodaZIP, and Durga Antivirus Pro.