Search for AWS API Gateway and you find a service at the center of modern applications. It is the managed entry point for your APIs. It receives calls, routes them to the right backend, and applies security along the way.
Amazon API Gateway is a fully managed AWS service for creating, publishing, securing, and monitoring APIs at any scale. People often call it AWS API Gateway. It acts as the front door for applications that reach your backend services. Those backends can run on AWS Lambda, containers, or servers.
APIs now carry most internet traffic. API calls made up 57 percent of the dynamic traffic on Cloudflare’s network, outweighing web pages. That shift is reshaping the market. API management is projected to grow from $8.86 billion in 2025 to $22.11 billion by 2031. That is a 16.45 percent compound annual growth rate.
Key takeaways
- Amazon API Gateway creates, publishes, secures, and monitors REST, HTTP, and WebSocket APIs on AWS.
- It handles authentication, throttling, caching, and monitoring so backend teams skip that work.
- HTTP APIs cost less and run faster, while REST APIs carry the fuller feature set.
- A full API management platform adds discovery, a developer portal, and governance across gateways and clouds.
What is Amazon API Gateway?
Amazon API Gateway is a fully managed AWS service for creating and running APIs. Those APIs connect client applications to backend services. Amazon launched it in 2015. It is now a core part of the AWS serverless stack.
Think of the gateway as a receptionist for your APIs. A request arrives, and the gateway authenticates the caller. It checks rate limits, transforms the payload if needed, and forwards the call. It then returns the backend response. You pay for the calls you receive, not for idle servers.
The service is popular for a reason. AWS Lambda is its natural pairing, and it is used by 65 percent of AWS customers according to Datadog. The gateway is the standard way to expose those functions as secure APIs. It fits equally well in front of containers, HTTP endpoints, or other AWS services.
How Amazon API Gateway works
Amazon API Gateway sits between your clients and your backends. You define an API as a set of resources and methods. You connect each method to an integration, then deploy it to a stage.
A single request moves through a clear sequence.
- The gateway receives the API call.
- An authorizer confirms the caller’s identity.
- The gateway validates the request and applies throttling.
- It maps the request to the backend integration.
- It maps the response back and returns it to the caller.
Along the way, the gateway can cache results, log activity, and emit metrics. This centralizes security, traffic control, and observability in one place. It keeps the backend code focused on business logic.
REST, HTTP, and WebSocket APIs
Amazon API Gateway supports three API types: REST APIs, HTTP APIs, and WebSocket APIs. Each targets a different need. Choosing the right one controls both cost and capability.
REST APIs carry the fullest feature set. HTTP APIs are the newer, lower-cost option built for speed. WebSocket APIs keep a two-way connection open for real-time messaging.
| API type | Best for | Notable features | Relative cost |
|---|---|---|---|
| REST API | Full API management on one API | API keys, usage plans, request validation, caching, edge and private endpoints | Higher |
| HTTP API | Simple, fast, low-cost proxying | Native JWT authorization, automatic deployments, regional endpoints | Lower |
| WebSocket API | Real-time, two-way messaging | Persistent connections, route messages by content | Per message and connection minute |
AWS sets out how to choose between them in its developer documentation. For most simple Lambda or HTTP backends, HTTP APIs are the cost-effective default.
Key features of Amazon API Gateway
The value of the gateway is the layer of controls it adds around your APIs. These are the features that matter most.
Authentication and authorization
Amazon API Gateway offers several ways to control access. You can use AWS Identity and Access Management (IAM), Amazon Cognito user pools, or Lambda authorizers. HTTP APIs also include native JSON Web Token (JWT) authorizers.
An older belief holds that the service does not support open token standards. That is no longer accurate. HTTP APIs support OpenID Connect and OAuth 2.0 through JWT authorizers. REST APIs handle the same tokens through Cognito or Lambda authorizers. You can also attach AWS WAF to filter malicious traffic. Resource policies limit access by IP or VPC. Mutual TLS is available on custom domains.
Integrations
An integration connects an API method to its backend. Amazon API Gateway supports Lambda integrations, HTTP integrations, and integrations with other AWS services. It also supports mock integrations for testing. Private integrations reach resources inside a virtual private cloud through a VPC link.
Throttling, rate limiting, and quotas
The gateway protects your backends from traffic spikes. By default it allows 10,000 requests per second with a 5,000 request burst per AWS Region. That is a soft limit you can raise. With usage plans and API keys, you set per-client rate limits and quotas.
Caching
REST APIs can add a dedicated cache to cut latency. You provision cache capacity and set a time to live from 0 to 3,600 seconds. Caching is a REST API feature and is not available for HTTP APIs.
Stages and deployments
A deployment is a snapshot of your API that you attach to a stage. Common stages are development, test, and production. Each stage has its own throttling, logging, and caching. REST APIs support canary release deployments for gradual rollouts.
Custom domains and endpoint types
You can map APIs to your own domain names with AWS Certificate Manager certificates. Amazon API Gateway offers three endpoint types. Edge-optimized endpoints route through Amazon CloudFront. Regional endpoints cut in-Region latency. Private endpoints allow access only inside a virtual private cloud. Endpoint choice affects both latency and security.
Monitoring and observability
The service reports metrics such as call count, latency, and error rates to Amazon CloudWatch. It also writes execution and access logs. AWS X-Ray adds distributed tracing, and AWS CloudTrail records management activity. Together they give a clear view of API health.
How much Amazon API Gateway costs
Amazon API Gateway uses pay-as-you-go pricing with no upfront cost. You pay for the API calls you receive and for data transfer out. REST API caching is billed separately by the hour.
The pricing gap between the two request-based types is wide. In the AWS US East region, HTTP APIs start at about $1.00 per million requests. REST APIs start at about $3.50 per million, plus data transfer. WebSocket APIs bill per message and per connection minute. A 12-month free tier covers one million calls a month for each type.
Common use cases
Teams reach for Amazon API Gateway when they need a managed entry point for APIs. Common patterns include serverless backends where the gateway fronts Lambda functions. A microservice facade gives many services one address. Real-time features such as chat or live dashboards run on WebSocket APIs.
It also serves as a secure proxy for legacy systems. It applies modern authentication and rate limits in front of older backends. In each case, the gateway removes the need to build that traffic layer by hand.
Limitations of Amazon API Gateway
Amazon API Gateway is strong at its core job, yet it has boundaries. Knowing them helps you plan the rest of your architecture.
The service adds a small amount of latency. It applies a default 29 second integration timeout and caps request payloads at 10 megabytes. It is tightly coupled to AWS, which is a benefit inside AWS and a constraint outside it. It also focuses on gateway functions rather than full API management. Productization, a rich developer portal, and cross-gateway governance are limited.
These gaps matter as an API program grows. Postman reports that 74 percent of respondents are API-first. It also found that nearly one-third of API publishers run more than one gateway. That is where single-gateway tooling starts to strain. Security adds pressure too. Salt Security reports that 99 percent of respondents hit an API security issue in the past year.
When you need more than an API gateway
A gateway routes and protects traffic. On its own, it does not help people discover APIs, package them as products, or govern them across clouds. Amazon API Gateway covers the gateway layer of AWS API management. The wider program of discovery, packaging, and governance sits above it. As API programs scale across teams, that wider job becomes the real work.
“Integration is like the headlights, a switch that needs to be flipped to accomplish the goal, but it isn’t the goal,” explains Brian Pagano, Chief Catalyst and VP at Axway, in a recent article on API strategy.
This is where a full API management platform complements the AWS gateway rather than replacing it. Axway Amplify sits above your gateways. It discovers APIs automatically, curates them into products, and gives consumers one marketplace. It governs APIs whether they run on Amazon API Gateway, another cloud, or an on-premises system.
Axway explains how this pairing works in its guide to the AWS API ecosystem with Amplify Engage. Lightweight agents connect your AWS API Gateway back to a central management plane. The short video below shows how Amplify unifies and secures APIs across gateways.
Amazon API Gateway alternatives
Amazon API Gateway is not the only option. The right choice depends on where your APIs run. Inside a single AWS account, the native gateway is hard to beat on convenience and price.
For multi-environment APIs, alternatives and complements include Kong, Apigee, Azure API Management, MuleSoft, and Axway Amplify API Management. Many enterprises settle on a mix. They keep Amazon API Gateway for AWS traffic. They add a management layer above it for discovery, a developer portal, and governance across every gateway. To go deeper, see this explainer on the different types of APIs and this guide to API security best practices.
Frequently Asked Questions
AWS API Gateway is used to create, publish, secure, and monitor APIs on AWS. It connects client applications to backend services. It handles authentication, throttling, caching, and monitoring for REST, HTTP, and WebSocket APIs.
Amazon API Gateway is the official name, and AWS API Gateway is the common shorthand for the same service. Common variants include api gateway aws, aws gateway api, and api aws gateway. Others include aws gateway, amazon gateway, and the plural aws api gateways. Some type it as aws apigateway.
Yes, Amazon API Gateway supports OAuth 2.0 and JWT through its authorizers. HTTP APIs include native JWT authorizers for OpenID Connect and OAuth 2.0. REST APIs validate the same tokens through Amazon Cognito or Lambda authorizers.
Amazon API Gateway uses pay-as-you-go pricing. HTTP APIs start around $1.00 per million requests. REST APIs start around $3.50 per million, plus data transfer. A 12-month free tier covers one million calls a month per type.
REST APIs offer the fuller feature set, including API keys, usage plans, request validation, and caching. HTTP APIs are cheaper and faster with native JWT authorization. That makes HTTP APIs the default for simple backends.
Amazon API Gateway gives AWS teams a reliable front door for their APIs. Many API programs grow beyond a single gateway. Pairing it with a platform such as Axway Amplify keeps those APIs discoverable, governed, and secure across every environment.