AWS API Gateway - The API Service That Actually Works

API Gateway is the thing AWS puts between your users and your actual services. It's basically a bouncer that checks IDs and deals with rate limiting so you don't have to write that tedious shit yourself. Works great until you get your first $3K AWS bill.

You get three flavors: REST APIs with all the bells and whistles, HTTP APIs that are faster and cheaper but with fewer features, and WebSocket APIs for when you need real-time communication. Pick your poison based on what you actually need, not what sounds impressive.

How It Actually Works

API Gateway runs on AWS's edge locations (CloudFront's network) when you pick "edge-optimized," or stays in one region if you choose "regional." Edge-optimized is marketing bullshit for "double your CloudFront bill" - learned this when our API Gateway costs were $200/month but CloudFront hit $800. Those execute-api URLs look like https://abc123.execute-api.us-east-1.amazonaws.com/prod and you can't change the ugly bastards without custom domains.

It plays nice with AWS Lambda (probably what you'll use most), Amazon Cognito for user management, and IAM for permissions. CORS configuration will make you question your life choices - the error messages are complete garbage like "CORS policy: Cross origin requests are only supported for protocol schemes: http, data, chrome, chrome-extension, https." Deployment stages confuse the shit out of everyone: "prod" and "production" are different things to API Gateway because fuck consistency. CloudWatch handles monitoring, assuming you want to pay $0.50/GB for detailed logs.

Performance Reality Check

API Gateway scales automatically, but your backend better keep up. Default limits are 10,000 requests per second per account - sounds generous until you do the math: that's $35K/month on REST APIs if you max it out. You can request limit increases through AWS Support, but expect a 20-question Spanish Inquisition about your traffic patterns.

Since the 2019 HTTP API launch, nobody should use REST APIs unless they need the features. HTTP APIs are actually 71% cheaper than REST APIs and faster too, but you lose request validation and caching. Lambda cold starts can add 500ms+ to your first request - especially brutal for those "just checking if the API is up" health checks. Edge-optimized might help global latency but adds complexity and CloudFront costs.

Who Actually Uses This Thing

TiVo uses API Gateway for streaming because it auto-scales during peak viewing times (think Sunday night HBO premieres) without them having to provision servers. WirelessCar needed sub-100ms response times for connected cars - edge-optimized endpoints solved their latency problem.

Most people use it for microservices APIs, mobile app backends, or modernizing legacy systems. It's particularly good when you need something up fast and don't want to manage load balancers, SSL certificates, and all that infrastructure nonsense. Just remember: it's another layer that can break, so plan accordingly.

Serverless APIs That Don't Suck

API Gateway + Lambda is probably what you'll use. It's the easiest way to build APIs without managing servers, until you discover Lambda cold starts during your first production demo. Cold starts are your biggest enemy - we've seen 2-second delays on first requests after idle periods, and 8+ seconds for Java Spring Boot apps. Provisioned concurrency starts at $0.015 per GB-second ($10.80/month for 1GB function running 24/7) and adds up fast, but fixes the problem if your budget can handle it.

Sync requests work for web APIs, async for long-running stuff. That $0.02/GB/hour caching fee adds up fast - we hit $400/month caching data we barely used. Response caching beats hitting your Lambda repeatedly, but cache invalidation is manual and takes 5-10 minutes to propagate.

Microservices Frontend (Single Point of Failure)

API Gateway works as a front door for microservices, but remember it's another layer that can break. It handles auth, rate limiting, and routing so your services don't have to. Just be aware that now everything depends on API Gateway being up.

You can integrate directly with DynamoDB, S3, and SNS without Lambda functions - saves latency and cost but adds complexity. Great for simple CRUD operations, terrible for anything requiring logic.

Security That Doesn't Get in Your Way

AWS WAF integration (REST APIs only) blocks common attacks like SQL injection. Worth it if you're getting hit by bots. Private APIs stay inside your VPC - great for internal services that shouldn't touch the internet.

Cognito handles OAuth/SAML if you need enterprise SSO. Resource policies let you restrict by IP or VPC. The security is solid, but each feature adds complexity - only enable what you actually need.

Making It Actually Fast

Caching works great if your data doesn't change often. Costs $0.02/GB/hour though, and cache misses still hit your backend. TTL settings are crucial - too short and you're wasting money, too long and you serve stale data.

Regional endpoints are faster and simpler. Edge-optimized sounds fancy but adds CloudFront costs and complexity. Pick regional unless your users are actually global. Lambda cold starts are your biggest enemy - keep functions warm with periodic pings if budget allows.

The Bill Reality Check

HTTP APIs are 71% cheaper than REST APIs - $1/million vs $3.50/million requests. Sounds great until you hit real scale: 100M requests/month is $100 (HTTP) vs $350 (REST). Add data transfer costs, caching fees, and CloudFront charges for edge-optimized APIs.

Usage plans are great until you realize customers will hit your rate limits in creative ways you didn't expect - like making 1000 requests in the first second of each minute to game your per-minute limits. Usage plans let you charge customers for API access and throttle them when they go over. CloudWatch metrics show where your money goes - sort by Count metric to find your most expensive APIs. Set billing alarms at $100, $500, and $1000 - we learned this the hard way when a traffic spike from a Reddit post mentioning our API cost us $2K overnight (mostly Lambda invocations, not API Gateway charges).