All Services
Serverless
Amazon API Gateway
Amazon API Gateway publishes, secures, meters, and observes managed HTTP, REST, and WebSocket APIs in front of Lambda functions, AWS services, and HTTP backends.
Explore pricing models, common use cases, infrastructure support, and the AWS services that commonly work with Amazon API Gateway.
API type, integration, and cost planning
AWS API Gateway: Pricing, API Types & Integrations
Start with the API protocol and controls the application needs, then price the gateway and every backend or security service separately. HTTP, REST, and WebSocket APIs are distinct products rather than interchangeable deployment modes.
Official AWS sources reviewed 2026-08-07.
Which API Gateway API type should I choose?
Use an HTTP API for streamlined HTTP routing when its feature set is enough. Choose a REST API for controls such as API keys, per-client throttling, request validation, caching, AWS WAF, or private endpoints. Choose a WebSocket API for persistent bidirectional sessions.
AWS comparison of REST and HTTP APIs
What drives AWS API Gateway pricing?
Estimate the selected API type, request or message volume, data transfer, REST API cache capacity, and private integrations. Lambda, authorizers, WAF, logging, and backend services have separate billing dimensions.
Official API Gateway pricing
What should an API Gateway design include?
Document routes, integrations, authorization, throttling, validation, observability, failure mapping, deployment stages, and contract compatibility. Test quotas, timeouts, retries, and backend failures before production traffic arrives.
API Gateway security best practices
Related AWS services for this plan
- AWS Lambda — Use Lambda for event-driven API handlers while keeping gateway and compute limits separate.
- Amazon Cognito — Use Cognito or another supported authorizer when the API needs managed user authentication.
- AWS WAF — Use AWS WAF with supported REST API stages for managed and rate-based request filtering.
- Amazon CloudWatch — Use CloudWatch access logs, metrics, dashboards, and alarms to observe API and integration failures.
Amazon API Gateway pricing and cost programs
Pricing model: API request usage
- On-Demand
- Available
- Reserved Instances or reserved capacity
- Not applicable
- Savings Plans
- Not applicable
- Spot
- Not applicable
Billing dimensions: API calls · Data transfer · Caching · Private integrations
Programs and modes: HTTP APIs · REST APIs · WebSocket APIs · Tiered request pricing
API type, request volume, cache size, and transfer determine pricing.
Free Tier: Available — verify current offers
Pricing reviewed 2026-07-25. Reviewed against the linked official AWS pricing page. Recheck regional rates and program terms before purchase.
Official AWS pricing
Official AWS sources reviewed 2026-07-21.
Why implement Amazon API Gateway?
- Provides a scalable API front door without operating reverse-proxy fleets, including routing, TLS termination, deployments, metrics, and supported authorization methods.
- Connects clients to Lambda, AWS services, private VPC resources, or public HTTP endpoints and supports synchronous request-response and bidirectional WebSocket patterns.
- Adds service-specific controls such as throttling, usage plans, validation, transformation, caching, AWS WAF integration, and private endpoints depending on API type.
How to implement Amazon API Gateway
- Choose HTTP APIs for lower-cost core HTTP routing, REST APIs when features such as API keys, request validation, caching, WAF, or private endpoints are required, and WebSocket APIs for persistent bidirectional sessions.
- Model resources or routes, methods, schemas, integrations, timeouts, status mapping, CORS, stages, deployments, custom domains, and DNS as infrastructure as code.
- Select IAM, JWT or Cognito, Lambda authorizer, or resource-policy controls; add quotas and throttling, structured access logs, metrics, tracing where supported, alarms, and contract or load tests.
Amazon API Gateway best practices
- Apply authentication and authorization at the narrowest useful boundary, grant integration roles least privilege, require TLS, and protect public REST APIs with AWS WAF when the threat model warrants it.
- Validate inputs, constrain payloads and request rates, use idempotency for retried mutations, avoid exposing backend errors, and keep secrets out of URLs and logs.
- Version contracts intentionally, use separate stages and accounts for environments, monitor latency and 4xx or 5xx errors by integration, and test quotas, throttling, timeout, and backend-failure behavior.
Amazon API Gateway use cases and server impact
- Serverless HTTP and REST APIs
- WebSocket application backends
- Governed facades for AWS services and private applications
Replaces managed API proxy and gateway servers, but not the business-logic backend; teams still own API contracts, authorization policy, integration behavior, and client compatibility.
Official implementation resources
How Amazon API Gateway works with other AWS services
Arrows show the documented technical direction. Reciprocal navigation does not imply a reverse technical dependency.
Official AWS sources reviewed 2026-07-25.
AWS WAF → Amazon API Gateway
A regional AWS WAF web ACL can inspect requests sent to a supported API Gateway API stage before integration processing.
- Why teams use it
- Teams use the pairing for managed threat rules and rate-based controls at a public API boundary.
- Permissions and networking
- Confirm the API type and stage are supported, then coordinate WAF rules with API Gateway throttling, authorization, and resource policies.
- Pricing and security caveats
- WAF request processing adds cost and can block valid clients when rules are poorly tuned; it does not authenticate callers.
Amazon Cognito → Amazon API Gateway
A Cognito user pool issues tokens that an API Gateway authorizer validates before allowing a request to reach an integration.
- Why teams use it
- The pairing centralizes user sign-in and token validation at the API boundary.
- Permissions and networking
- Validate issuer, audience, scopes, expiration, and route authorization; use TLS and avoid placing tokens in URLs or logs.
- Pricing and security caveats
- Cognito and API Gateway are billed separately. Authentication establishes identity but does not replace resource-level authorization inside the application.
Amazon API Gateway → AWS Lambda
API Gateway transforms an accepted HTTP, REST, or WebSocket request into a Lambda invocation and returns the integration response to the client.
- Why teams use it
- Teams gain a managed API front door while Lambda supplies independently deployable business logic.
- Permissions and networking
- Grant invocation permission narrowly, validate request payloads, set timeouts and concurrency controls, and avoid leaking backend errors.
- Pricing and security caveats
- API requests, Lambda invocations, duration, and data transfer are separate charges; synchronous API latency and timeout limits bound long-running work.
Architecture patterns using this service
- Build a secure serverless API on AWS — Authenticate users with Amazon Cognito, validate requests at Amazon API Gateway, run business logic in AWS Lambda, and store application data in Amazon DynamoDB.