‫So we have now created our API,
‫and it is time to make it available for our customers,
‫and we may wanna charge them some money for it.
‫So for this, there is a concept of usage plans and API keys.
‫So the way it works, that we create a usage plan,
‫in which we define, who can access
‫one or more API stages and method,
‫how much and how fast they can access them,
‫and which API keys are linked to this usage plan,
‫to identify the clients and meter their access.
‫Then we can also configure throttling limits.
‫So, how fast their users can target our API,
‫and quotas, in case we just wanna say, for example,
‫that only 10,000 requests a month can be done
‫on our API before you need to pay some more.
‫And then we can create API keys.
‫These are just string to distribute to your customers,
‫and they look like this.
‫And these API keys allow your customers
‫to securely use your API gateway,
‫and authenticate their requests.
‫And you can use this in conjunction with the usage plan
‫to control access.
‫And if you enable any throttling limits,
‫it is applied the API key level.
‫Overall, the quota limits is the overall number of requests.
‫So, by using the usage plan and the API keys,
‫as we'll see in the hand-on,
‫we're able to really monitor,
‫offer our API, and limit it, for our customers.
‫So what's the order in which you create an API key
‫and a usage plan?
‫So, in order to configure a usage plan,
‫you need to remember it.
‫You need to first create one or more API,
‫and then configure the methods that will require an API key,
‫and then deploy the API to your stages.
‫Then you would generate or import API keys,
‫to distribute to application developers.
‫So they're your customers who will be using your API.
‫And then you create a usage plan,
‫with the desired throttle and quota limits.
‫And finally, you need to associate the API stages
‫and API keys with the usage plan.
‫And that's what we'll do in this lecture.
‫And the last step, if you forget it,
‫then things will not work.
‫Finally, the callers of the API must supply an API key,
‫in the x-API-key header requests into the API.
‫So to make it very clear, let's go into the hands-on
‫and practice the usage plans and the API keys.
‫So, let's go ahead and create our method
‫that is going to be controlled by an API key.
‫So I'm going to create a new resource,
‫call it API key for this demo,
‫and then create the resource.
‫Then underneath, I will create a method,
‫and this method is going to be a GET to make things simple.
‫And then this method is going to be a Mock,
‫to make things even more simple,
‫so we don't need to integrate with any back-end.
‫I'll press save.
‫And if you wanna see what Mock does,
‫you can just test it, and then press test,
‫and it returns no data, but at least it says yes, it works.
‫So back into the API execution,
‫I can set a method request.
‫And in here, I can set that my API key is required.
‫Yes, so true.
‫So now in this method, I need an API key to access it,
‫otherwise, things will not work.
‫So next, let's define usage plans, and API keys.
‫So I'm going to create an usage plan
‫from the left-hand side,
‫I'll call it demo plan.
‫And in here, I can enable both throttling and quotas.
‫So throttling is saying how many requests per second,
‫I want to get maximum, so 10, maybe.
‫And the burst of request, is how much
‫I'm allowing my customers to go over it,
‫just in case they have a few more bursting requests.
‫So maybe five.
‫Then do i want to enable a quota?
‫And I wanna say yes.
‫You cannot do more than 10,000 requests per month,
‫otherwise, you would pay more.
‫So I'll click on next,
‫and here is my usage plan.
‫But currently, it's not associated with any stages.
‫So I can associate it with a stage.
‫So with this API, and then the stage is going to be prod.
‫Now note we haven't deployed our new resources to prod,
‫so this is not going to be active.
‫So I'll say yes, here we go.
‫And, this is associated with prod.
‫No methods have been configured,
‫so we can configure a method throttling
‫but we'll do this once we go ahead and deploy our API.
‫So, I'll click on next,
‫and then we need to add API keys to the usage plan.
‫So I need to create an API key first,
‫and add it to the usage plan,
‫which I can do from the left-hand side as well.
‫So I'll click on this button,
‫and this API key, so this is my cool customer.
‫So I'll call it cool customer.
‫Under the API key, you can get a custom value,
‫or automatically generate it.
‫So I'll get an auto-generate,
‫and the API gateway will give me a value.
‫And press save.
‫So this cool customer has been added to my usage plan,
‫and then I can click on done.
‫And now we have created our first usage plan.
‫Coz we can see, this is associated with the prod stage,
‫there is the rate, the burst and the quota.
‫And we can go to the API keys and find this API key.
‫So if I do usage,
‫I can see how many times they have been used.
‫So currently nothing, and by extension,
‫I can create an extra extension or request for API key.
‫Okay, if I click on this API key itself,
‫I can see that we are now in the API key panel,
‫and I can show this API key.
‫And this is what I would be sending to my customers,
‫so they can start using my API.
‫So this is great, my API key is now associated
‫with my usage plan, which is extremely important.
‫So now let's go into my API.
‫And I will find my first API.
‫And I will deploy this, I will deploy this API into prod.
‫And by the way, canary is enabled,
‫so I'm just going to disable canaries.
‫So I'll go to prod, and i will go to canary
‫and delete the canary.
‫We don't need it anymore.
‫And back into my resources, action, deploy API,
‫into prod,
‫and deploy.
‫So now, my prod has a
‫API key routes, okay,
‫and this needs an API key to work.
‫So this is the API key we used from our customer.
‫So back into our usage plan.
‫If we go to the demo plan,
‫we can configure method throttling, if we wanted to,
‫and say okay, on top of it, this API key method,
‫the GET, you can only do five requests per second,
‫and a burst of two,
‫so we're really able to pry it out and test it.
‫There is a concept of a marketplace,
‫where you can sell your API keys directly
‫onto the AWS marketplace, but for now, this is out of scope.
‫Okay, so now if we go to the stages,
‫and go to prod,
‫and we go to this API key method,
‫and we just click on it,
‫as you can see, we see message forbidden.
‫This is because my API key has not been passed,
‫and therefore everything is not working.
‫So now we have to make this request work,
‫because we're forbidden.
‫So as you can see now,
‫I've opened something called Insomnia.
‫So Insomnia is a desktop client for REST,
‫So if you go to Insomnia or REST,
‫I would highly recommend downloading this.
‫This is free, and so this is using,
‫this is going to be a REST client for my desktop,
‫to make API calls onto this API,
‫but I can supply now some headers.
‫So, I'm going to create a new request,
‫and I'll call it API key example.
‫And it's going to be a GET,
‫and on top, I can enter the URL that I had right here.
‫So if I click on send, again,
‫I'm getting the message forbidden, just like we have.
‫But now to use the API keys,
‫I can go ahead and specify
‫the API key header into my request.
‫So for this, I first need to retrieve my API key
‫for my cool customer.
‫And here is the value,
‫and then in Insomnia,
‫on the right-hand side,
‫I'm going to add a header called x-API-key,
‫and the value of which is the API key of my customer.
‫So I can pass in the value in here,
‫and now that I've created a header,
‫this is a request header
‫with the right value of the API key.
‫If I send it, I'm getting a 200,
‫and my request is now working.
‫So this is a cool demo, because now,
‫this API key was used once.
‫And so if we go to our usage plans,
‫and go to our demo plan, and look at the metering,
‫so I'm going to API keys, and then click on usage,
‫as we can see, and its going to take a while to reflect.
‫So it says zero requests but very, very soon,
‫it should say one request,
‫when it is being registered by my API gateway.
‫So that would be the whole idea behind API keys.
‫Now I can see how many requests are made,
‫I can bill my customer for these requests,
‫and I can secure my API's with API keys.
‫So that's it.
‫I hope you liked it and I will see you in the next lecture.