Hi, everyone, and welcome back.
Now, in today's video, we are going to discuss about the API keys and usage plans.
Now, at a high level overview API keys are an alphanumeric string values that you can distribute to
your customers.
And this in turn will allow the customers to access your API.
For example, in this diagram you'll see that a client is sending a get request to product to the API.
However, in the response you are getting forbidden message and this is something that might be important
because you do not really want the entire internet to connect to your API.
Depending upon the use cases, you can add a certain level of authentication and in API gateway that
can be achieved through API keys.
Now, once you have the API key that is implemented, you can use the X API key header while connecting
to the API endpoint.
Now if you look into this specific screenshot, you have a header that we are sending along with the
curl request of API key and this is where the API key you need to add.
And then you send the request to the API and in the response you are getting.
Hello from lambda in case if you do not supply this API key then you will get a forbidden message.
Now, before we continue, let's also have a quick demo associated with this.
Now for one of the rest APIs, I have the authentication which is enabled, so the API keys will be
required.
So in turn at this stage whenever we send a request to the invoke URL.
Immediately, you see, we get a forbidden message.
And as part of this API, I also have an API key.
So there are certain API keys that are available.
If you look here, there is an API key over here, so you have to make use of this API key or you have
to send this API key to the customers who wants to make use of this API and customers have to supply
this x API key header whenever they make the request to the API.
And if we just run this, we are getting halo from lambda.
Great.
So I hope with this you understood the importance of API key in the oral authentication.
With the API, you also have an important feature of usage plan that also integrates with the API key
and at a high level overview, the usage plan specifies who can access one or more deployed API stages
and methods, and you can also set various important configurations like throttling the rate of request
and others.
So the overall usage plan uses the API keys to identify the API clients and who can access the associated
API stages for each key.
Now, for example, you see that we have one demo key and associated with this demo key is this specific
usage plan.
So both of them are integrated.
Now in this usage plan, you specify what is the API, the stage, and along with that you can specify
the throttling.
So at this stage you have ten requests per second.
The post is 20 request per second and you have the API keys and all of the API keys that is associated
with a usage plan will have this set of limits and also they will be able to access the appropriate
API and the appropriate stage.
All right.
So both of them are integrated, so you have to use both of them in order to make things work.
Now, before we look into it further, let me also quickly show you a better understanding on how both
of them are integrated.
So whenever you create an API key, let's just call it as CAPA Labs hyphen key.
Again, this is just a demo to understand things in detail.
So whenever you create a key for a customer, this is the key.
Now, at this stage the key is not associated with any usage plan, so you will not be able to perform
operations using this key.
So let's go ahead and try it out.
So what I'll do, I'll copy this specific key.
And from the air.
Let's clear the screen and let's replace with our new key.
All right.
Now, if I press enter, you are still getting a forbidden message.
So even with the key, there is no real impact at this stage.
Now, in order for key to have impact, you have to associate it with a usage plan.
So at this stage, in fact, let's go back.
Now, whenever you create a usage plan, let me just quickly create a test usage plan.
You can enable throttling.
So let me just say rate of 50 and burst of 100 requests.
You can enable quota.
Let me just deselect it.
I'll do next.
And here you can associate the API stage.
So let me associate the API that we have.
And within this API, I have one stage which is deployed, which is Dev.
I'll quickly add this.
Let's quickly do our next and next you can add the API key to the usage plan.
The name of the API key was Key Labs key.
I'll save it and I'll complete the overall process.
So now our API key is associated with the usage plan.
Now, generally whenever you create a usage plan, it generally takes around a few seconds for it to
get into effect.
Now, at this stage, when you run the same set of command once more, you see we are getting the response
here, which is Halo from Lambda.
Great.
Now, before we conclude certain important pointers to note, first one is that after you create, test
and deploy your APIs, you can use the API Gateway usage plan to make them available as a product offering
to your customers.
Second important point is that you can configure the usage plan and the API keys to allow customers
to access selected APIs and also begin throttling the request.
You do not want one customer to send 99% of the overall request.
You can begin throttling to make sure that your API is available for all and this can be implemented
at the API or even the API method level.
Next important point is that the API gateway throttles the request to your API using the token bucket
algorithm where a token counts for a request and within your when a request submission exceeds the steady
state request rate and the bus limits, then the API gateway will begin to throttle and when the throttling
starts, the client may receive 4 to 9 to many requests.
Message back.
Along with that, also note that there is a default quota of 10,000 requests per second applicable at
per account per region.
So in case if you exceed that again, the clients may receive 4 to 9 too many requests.
Great.
So these are some of the pointers associated with the API keys and usage plans, and with this will
conclude today's video.