So let's understand what all these options on the left here do, specifically usage plan and so on
For usage plan API keys, to understand these menu items,
it's important to understand how your API may be used.
You can create your own API for your own applications, like we do in this course.
We have some web app,
we will have one at the end of the course with which we want to connect to a back-end because our web
app happens to be a single page application,
so it runs on a static server, executes no server-side code,
so we need a back-end to connect to to store data in a database, fetch data and so on.
Now if we have our own API with our own front-end, API keys aren't really interesting to us because we control
everything. We create that API, we deploy it on a stage here and we get this URL which we can use
in our own application.
Now theoretically if other people were to inspect the source code of our app, they could steal this URL
and they could try using it on their own but that wouldn't really help them because the API is only
used by us and therefore, pretty much suited to our application
and if we use authentication which we probably do and we will learn about this in this course, there's
even less people can do with that link.
Now API keys are interesting if you plan on creating an API which is shared with other developers,
so not with users of your app but with other developers creating their own apps.
Think about the Google Maps API,
they have an API where you can send coordinates and get back address information.
Now if you want to use that, you have to register on Google and you will get an API key by them.
It's that key which you then have to pass with any request you send to the API because you identify yourself
with that key
and Google can also track your usage of the API and possibly limit you if you exceed your limits or
anything like that
and you can do the same here in API Gateway.
You can create API keys here, sign them any customer name and of course, there are also ways of automatically
generating them if you have like an automatic system where people can register for your API
but let's do it manually and you will get such an API key then, here. That's just a random key and the
customer for which you generated the key can now send to this key with requests to identify themselves,
Ww'll soon learn that you can indeed block requests which are sent without API keys.
You can even set up usage plans to restrict the usage of your API by certain keys,
so you could assign a usage plan to this API key and say you are only allowed to access my API, let's
say 1000 times per second, per minute or anything like that.
This is what you can do with API keys and usage plans,
it's important if you plan on exposing your API to other developers,
it's not important if you do what we do in this course and you use your API only on your own.
Now what about the other options?
If you have a look at custom domain names or specifically if you have a look at the domain our first
API is hosted on,
it should be pretty clear what custom domain names does. It allows you to connect your own domain which
you own to your API, so that you don't have these generic AWS URL which works fine but your own
domain, which might especially be important if you do indeed plan to expose your API to other developers
too. Client certificate is
important if you plan on forwarding incoming requests to yet another HTTP endpoint
and on that other HTTP endpoint, you want to validate that the request this endpoint gets indeed
stems from your API Gateway API
and with a client certificate, you can generate a certificate which proves this to your final API
endpoint on a different API,
not something we'll look into this course. And on settings, you can simply manage the roles, the
permissions this service has because keep in mind, by default, each AWS service has no permissions at
all,
you have to give permissions so that the services are able to do something
and if you want to generate log files for API Gateway for example, you would have to give it the
right permissions and you can do that here.
So that's the options here,
not something we will work on in this course. For us,
the API specific items here are more interesting.
So let's dive into that and understand how an API really works in a high level in the next lectures.