Techie BabajiLearn to Code. Build Real Skills.
AWS · Compute & Storage

API Gateway

API Gateway is the front door for your APIs: it receives HTTP requests, authenticates them and forwards them to Lambda or other backends.

Intermediate 5 min Lesson 9 of 30
Before you start:Lambda
0/30 in AWS
On this page · 5 min · Intermediate

On this page

  1. Learning objectives
  2. Explanation
  3. Code example
  4. Step by step
  5. Real-world use
  6. Common mistakes
  7. Best practices
  8. Remember this
  9. Practice exercise
  10. Mini quiz
  11. Related topics
  12. My notes
Reading time
5 min
Difficulty
Intermediate
Updated
Oct 29, 2026

Related tutorials

Interview questions

Learning objectives#

  • Compare HTTP APIs and REST APIs
  • Create routes with Lambda integrations
  • Configure CORS and JWT authorization
  • Use stages and throttling

Explanation#

HTTP APIs are simpler, cheaper and faster — the best choice for most Lambda-backed APIs. REST APIs add features such as API keys, usage plans, request validation and caching.

A route (GET /products) maps to an integration (a Lambda function, an HTTP endpoint or an AWS service).

JWT authorizers validate tokens from Amazon Cognito or any OpenID Connect provider before your code runs.

Stages (dev, prod) are deployments with their own URLs and settings; throttling protects backends from overload.

Code example: Quick-create an HTTP API in front of Lambda#

ShellQuick-create an HTTP API in front of Lambda Illustrative
aws apigatewayv2 create-api --name products-api --protocol-type HTTP \
  --target arn:aws:lambda:ap-south-1:123456789012:function:products \
  --cors-configuration AllowOrigins=https://techiebabaji.com,AllowMethods=GET,POST


aws lambda add-permission --function-name products \
  --statement-id apigw-invoke --action lambda:InvokeFunction \
  --principal apigateway.amazonaws.com \
  --source-arn "arn:aws:execute-api:ap-south-1:123456789012:<api-id>/*"
Expected output
{
  "ApiEndpoint": "https://<api-id>.execute-api.ap-south-1.amazonaws.com",
  "ProtocolType": "HTTP"
}

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

  1. Quick create builds an API with a default route and stage pointing to the Lambda function.
  2. CORS allows only your front-end origin.
  3. add-permission lets API Gateway invoke the function — without it requests fail with 500.

Real-world use case#

A React front end calls GET /products and POST /orders on an HTTP API; Cognito-issued JWTs protect the order routes.

Common mistakes#

Forgetting the Lambda invoke permission

API Gateway needs a resource-based permission on the function.

CORS set to "*" with credentials

Allow only the origins that need access.

Best practices#

  • Prefer HTTP APIs unless you need REST API features
  • Use JWT authorizers for user-facing APIs
  • Set throttling limits
  • Enable access logging to CloudWatch

Remember this#

HTTP API = simple and cheap. REST API = more features.

Route → integration → Lambda.

API Gateway needs permission to invoke Lambda.

Practice exercise#

Your task: Add a route GET /products/{id} to an existing HTTP API integration.

Show solution
Shell Illustrative
aws apigatewayv2 create-route --api-id <api-id> --route-key "GET /products/{id}" --target integrations/<integration-id>

Mini quiz#

API Gateway quizMultiple choice Question 1 of 1

Which API type is usually best for a simple Lambda-backed API?

Score so far: 0/0

Want more? Practise all AWS MCQs · AWS interview questions

My notes#

Saved in this browser.

Progress is saved in this browser. Sign in to sync.