AWS API Gateway Support
API Gateway throttling, usage plans and API keys.
API Gateway throttles at several levels at once: the account in each Region, the stage and method, and each client through usage plans. A 429 can come from any of them. We find which limit is firing and set limits that protect your backend without blocking real customers.
When You Need This
The situations where this work pays for itself.
Signs it is time
- Clients receive 429 Too Many Requests from your API
- One client or integration partner hammers the API and affects others
- You want to offer tiers with different rate and quota limits
- Backend Lambda or database overloads when traffic spikes
- You are unsure whether an API key is a security control
What you get
- A map of which throttle limits apply to each route
- Usage plans and keys in infrastructure as code
- Dashboards and alarms for throttled requests per client
- Client retry guidance and a load test report
How we do it
A clear, safe process you can follow along with.
1. Identify which limit is firing
We check CloudWatch metrics such as Count, 4XXError and Throttle-related logs, access logs by API key and method, and the account-level quota in Service Quotas for your Region. The quota values change, so we read the current ones.
2. Set stage and method throttling
We set default and per-method rate and burst limits so an expensive route cannot consume the whole account allowance.
3. Design usage plans
A usage plan attaches rate, burst and quota limits to API keys. We create tiers that match your customer plans, and associate each key with the right stage.
4. Use API keys correctly
Keys identify callers for throttling and metering. They are not authentication, so we pair them with a Cognito, JWT, IAM or Lambda authorizer for real access control.
5. Protect the backend behind the gateway
Gateway limits do not replace backend limits. We also set Lambda reserved concurrency, or buffer writes with SQS, so a burst cannot overwhelm a database.
6. Return a client-friendly 429 and test
We add Retry-After guidance for clients and use exponential backoff with jitter in your SDKs, then load test to confirm limits trigger where intended.
Mistakes we help you avoid
Common ways this goes wrong, and what we do instead.
Treating API keys as passwords
Keys are sent in a header and are easily shared. Use an authorizer.
One global limit for all routes
Cheap and expensive routes need different limits.
Raising limits without checking the backend
You move the failure from the gateway to your database.
Forgetting to associate keys with a stage
A key not linked to a usage plan stage is not limited as you expect.
Frequently Asked Questions
What do rate and burst mean in API Gateway?
Rate is the steady requests per second allowed, and burst is how many requests can arrive at once above that. It follows a token bucket model.
Do HTTP APIs support usage plans?
No. Usage plans and API keys are REST API features, while HTTP APIs offer route-level throttling. We help choose which fits your needs.
Can I get a higher account limit?
Account-level throttle quotas can be raised through Service Quotas where AWS allows it. We prepare the request with traffic evidence.
Want Help With API Gateway throttling, usage plans and API keys?
Schedule an appointment. Tell us about your environment and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required