Amazon API Gateway
Amazon API Gateway is a managed service for creating, publishing, maintaining, monitoring, and securing APIs that connect applications with backend services.
What Amazon API Gateway is
Amazon API Gateway is a managed service for creating, publishing, maintaining, monitoring, and securing APIs that connect applications with backend services. It supports REST, HTTP, and WebSocket APIs, including two-way real-time communication. Developers can integrate with services such as AWS Lambda, Step Functions, Elastic Beanstalk, EC2, and public HTTP endpoints; HTTP APIs can also route to certain private services. The console connects with Amazon CloudWatch for call, latency, and error metrics, alarms, and execution logs. Authorization choices include IAM, Lambda authorizers, and OIDC and OAuth 2.0 support. REST APIs can use optional API keys with per-key permissions, throttling, and request quotas. Other traffic controls include request throttling and configurable caching for REST APIs. API Gateway Portals provide managed AWS-native locations to discover, document, and govern REST APIs, and the service can generate client SDKs for languages including JavaScript, iOS, and Android. Pricing is usage-based, with no minimum fees or upfront commitments; a free tier is available to new AWS customers for up to 12 months within monthly allowances, with excess use charged at standard rates. WebSocket messages can be up to 128 KB and are metered in 32 KB increments. AWS secures the cloud infrastructure, while customers remain responsible for security in the cloud based on their use, data, and regulatory requirements.
Good
- Supports REST, HTTP, and WebSocket APIs.
- Integrates with multiple AWS services and public HTTP endpoints.
- CloudWatch integration provides metrics, alarms, and logs.
- Offers a free tier for new AWS customers.
- Can generate JavaScript, iOS, and Android SDKs.
Watch out
- Free-tier use is limited to listed monthly allowances and up to 12 months.
- WebSocket messages are limited to 128 KB.
- Other AWS services may incur additional charges.
Who it suits
Amazon API Gateway suits teams connecting applications to backend services through REST, HTTP, or WebSocket APIs. It may be useful to developers who need managed monitoring, traffic controls, authorization options, or client SDK generation.
Verdict
Amazon API Gateway combines API creation with monitoring, authorization, and traffic controls across three API types. Consider its usage-based charges, free-tier limits, and customer-side cloud security responsibilities when evaluating it.
Plans and prices
From Amazon API Gateway's own pricing page, checked 14 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Free tier | Free | 1M REST API calls/month · 1M HTTP API calls/month · 1M WebSocket messages/month · 750,000 WebSocket connection minutes/month · monthly for up to 12 months for new AWS customers |
| HTTP APIs | $1 a month | $1.00 per million for first 300M requests · $0.90 per million above 300M in example · per million requests; tiered |
| WebSocket APIs | $1 a month | Messages up to 128 KB · metered in 32 KB increments · per million messages plus $0.25 per million connection minutes in example |
| REST APIs | $3.50 a month | $3.50 per million first tier · $2.80 per million next tier · $2.38 per million highest shown tier · per million API calls in example regions |
| API Gateway Portals | $125 a month | Includes 10 PortalProducts · up to 40 ProductRestEndpoints per PortalProduct · monthly portal charge in example |
| Pay-as-you-go | — | No minimum fees or upfront commitments · Private APIs have no data transfer out charge · Additional charges may apply for other AWS services · Usage-based: API calls and data transferred out for HTTP and REST APIs; messages and connection minutes for WebSocket APIs. |
The facts
Each one read from Amazon API Gateway's own pages, with the date it was checked.
What it does
- API keys
- For REST APIs, API keys can have per-key access permissions, throttling, and request quota plans; their use is optional.checked 5 Oct 2026
- API keys and quotas
- REST APIs can issue API keys, attach fine-grained permissions and apply usage-plan throttling and quotas.checked 14 Oct 2026
- API types
- The service supports HTTP APIs, REST APIs and WebSocket APIs for persistent two-way communication.checked 14 Oct 2026
- Authorization
- Authorization options include AWS IAM and access policies, Lambda authorizers, and native OIDC and OAuth 2.0 support.checked 5 Oct 2026
- Backend integrations
- Features pages list integrations with Lambda, Step Functions, Elastic Beanstalk, EC2, public HTTP endpoints, private ALBs, private NLBs and AWS Cloud Map.checked 14 Oct 2026
- Backends
- It can integrate with AWS Lambda, Step Functions, Elastic Beanstalk, EC2, and publicly accessible HTTP endpoints.checked 5 Oct 2026
- Caching
- REST APIs offer optional configurable caching billed hourly according to cache size.checked 14 Oct 2026
- CLI and API
- AWS provides a control API, AWS CLI commands and SDKs for managing API Gateway resources; the CLI can generate SDKs with get-sdk.checked 14 Oct 2026
- Client SDKs
- API Gateway can generate client SDKs for languages including JavaScript, iOS, and Android.checked 5 Oct 2026
- Compliance
- AWS states that API Gateway can support architectures covered by SOC, PCI, ISO, FedRAMP and HIPAA compliance programs.checked 14 Oct 2026
- Developer portals
- API Gateway Portals provide AWS-native portals for discovering, documenting and governing REST APIs.checked 14 Oct 2026
- Documentation depth
- The documentation site includes conceptual guides, tutorials, API references, OpenAPI import/export procedures and security guidance.checked 14 Oct 2026
- Licence
- AWS customer terms contain proprietary-rights provisions governing AWS services; API Gateway is not published as open-source software.checked 14 Oct 2026
- Lifecycle management
- REST APIs support multiple simultaneous versions, stages such as alpha/beta/production and custom-domain associations.checked 14 Oct 2026
- Limit: complexity
- Reviewers repeatedly describe advanced configuration, stages, authorizers and the console as difficult for beginners.checked 14 Oct 2026
- Limit: pricing
- G2 and Capterra reviewers say the usage-based pricing becomes difficult to predict or expensive at higher traffic volumes.checked 14 Oct 2026
- Monitoring
- The API Gateway console integrates with Amazon CloudWatch for API call, latency, and error metrics, alarms, and execution logs.checked 5 Oct 2026
- Notable outage
- TechRadar reported that an AWS operational issue on October 20, 2025 disrupted many business, gaming and banking services worldwide and was linked to DynamoDB API errors in us-east-1.checked 14 Oct 2026
The company
- Founded
- 2006checked 23 Sep 2026
- Headquarters
- Seattle, Washington, United Stateschecked 23 Sep 2026
- Maker
- Amazon Web Services says it launched in 2006; the opened AWS About page does not state its headquarters.checked 5 Oct 2026
- Maker headquarters and size
- Gartner lists Amazon Web Services as founded in 2006, headquartered in Seattle, publicly owned and employing more than 10,001 people.checked 14 Oct 2026
- Maker ownership
- AWS states that Amazon Web Services has operated since 2006 and is part of Amazon.checked 14 Oct 2026
Money
- Limit: support and billing complaints
- Trustpilot reviewers frequently report unresponsive support, unexpected charges, account suspensions and difficult cancellation workflows.checked 14 Oct 2026
The full review of Amazon API Gateway
Overview
Amazon API Gateway is a managed cloud service for creating and operating APIs that connect applications to backend services. It best suits teams building on AWS that need REST, HTTP, or real-time WebSocket APIs. Its breadth of integrations and controls is a strong fit for AWS workloads, though usage-based charges and customer security responsibilities call for careful planning.
Key features
API Gateway handles request-response traffic through REST and HTTP APIs, and two-way real-time communication through WebSocket APIs. It can connect to Lambda, Step Functions, Elastic Beanstalk, EC2, and public HTTP endpoints. HTTP APIs also support private routes to services behind application or network load balancers and IP-based services registered in AWS Cloud Map. That makes the service useful when an AWS application spans several backend types; private integrations, however, are an HTTP API capability.
Traffic throttling is available across API Gateway, while REST APIs can add caching with configurable keys and time-to-live settings. Optional REST API keys can carry per-key permissions, throttling, and request quotas. These are practical controls for managing client access, but the key-based quota features are scoped to REST APIs.
Authorization options include IAM and access policies, Cognito user pools, JWT/OIDC/OAuth 2.0, Lambda authorizers, API keys, and mutual TLS. The console connects with CloudWatch for call, latency, and error metrics, alarms, and execution logs, giving operators a route from API activity to monitoring without treating authorization and visibility as separate afterthoughts. API Gateway can also generate client SDKs for languages including JavaScript, iOS, and Android.
API Gateway Portals provide AWS-native portals to discover, document, and govern REST APIs. WebSocket messages are limited to 128 KB and metered in 32 KB increments; ping and pong control frames are not metered. Those limits matter for real-time applications that send large payloads or sustain many connections.
AWS describes the service as supporting architectures intended to meet SOC, PCI, ISO, FedRAMP, and HIPAA requirements. AWS secures the cloud infrastructure, but customers remain responsible for security in the cloud according to their service use, data, and regulatory obligations.
Pricing
Free Tier
The Free Tier costs nothing for up to 12 months and is limited to new AWS customers. It includes 1M REST API calls/month, 1M HTTP API calls/month, 1M WebSocket messages/month, and 750,000 WebSocket connection minutes/month. Usage beyond the monthly allowances is charged at standard rates, so it is a useful starting allowance rather than an indefinite no-cost plan.
Pay-as-you-go
Custom pricing applies to the usage-based plan: HTTP and REST APIs are charged by API calls and data transferred out, while WebSocket APIs are charged by messages and connection minutes. There are no minimum fees or upfront commitments, and private APIs have no data transfer out charge. Other AWS services may add charges, so this model suits workloads that can track usage but is less predictable than a fixed subscription. The pricing model is paid, with a stated starting point of From $1.
Platforms
API Gateway is a cloud deployment supporting web, Android, and iOS, as well as API use. Its supported protocols are HTTP, REST, and WebSocket. AWS launched in 2006.
Who it's for
Choose API Gateway when an AWS-based team wants managed API creation, varied backend integrations, monitoring, and multiple authorization options in one service. It is less compelling for buyers who need fixed, predictable pricing or want to avoid taking responsibility for security configuration, data, and regulatory requirements in the cloud.
Pros and cons
- Pro: REST, HTTP, and WebSocket APIs cover conventional and two-way real-time traffic within one managed service.
- Pro: AWS backend integrations, CloudWatch monitoring, and several authorization approaches support operational and access-control needs.
- Pro: The new-customer Free Tier includes monthly allowances for all three API types and WebSocket connection time.
- Con: Usage-based charges depend on calls, data transfer, messages, and connection minutes, and other AWS services can add costs.
- Con: Free Tier allowances last up to 12 months and excess use is charged at standard rates.
- Con: REST-specific caching and API-key quota controls do not extend across every API type.
Alternatives
API Gateway Software, API Management Software, and API Developer Portal Software are category lists for comparing options by need.
- Gravitee API Gateway is worth considering for a freemium option with a free Apache 2.0 community edition and self-hosted, Linux, Windows, API, and web platforms.
- Kong Gateway may fit teams that want a 30-day free trial with no credit card required, no Gateway limits, and 30 days of analytics retention.
- KrakenD API Gateway is an alternative for self-hosted use with unlimited requests, APIs, and AI workloads in its free Community Edition.
- Tyk Gateway offers a free open-source API gateway and a free trial, making it another freemium option to compare.
- Emissary-ingress is a free open-source Kubernetes API gateway for Linux and self-hosted use.
- Envoy Gateway is a free open-source project for self-hosted API deployments.
- NGINX Gateway Fabric is a free self-hosted Kubernetes project with Gateway API support that varies by resource.
- Spring Integration is a free, Apache 2.0 licensed framework dependency for Java/Spring applications.
Verdict
Amazon API Gateway is the strongest fit for teams already invested in AWS that need managed REST, HTTP, and WebSocket APIs with AWS integrations and built-in monitoring options. Its flexibility is the main reason to choose it; usage-sensitive costs and the customer's share of cloud security are the clearest reasons to look elsewhere.
Getting started
- Open the Amazon API Gateway website.
- Choose the cloud service for your API deployment.
- Select REST, HTTP, or WebSocket API support for your use case.
- Connect a supported backend such as Lambda, EC2, or a public HTTP endpoint.
- Configure authorization, throttling, and any REST API caching or API key settings.
- Use the Free Tier if eligible, or pay for usage-based service consumption.
Limits worth knowing
The Free Tier is free for up to 12 months for new AWS customers and includes monthly allowances of 1M REST API calls, 1M HTTP API calls, 1M WebSocket messages, and 750,000 WebSocket connection minutes. Usage above those allowances is charged at standard rates. WebSocket API messages can be up to 128 KB and are metered in 32 KB increments; ping and pong control frames are not metered.
Questions
What does the Free Tier include?
For up to 12 months, new AWS customers receive monthly allowances of 1M REST API calls, 1M HTTP API calls, 1M WebSocket messages, and 750,000 WebSocket connection minutes. Usage above these amounts is charged at standard rates.
Which API protocols does it support?
It supports HTTP, REST, and WebSocket APIs. WebSocket APIs support real-time two-way communication.
What authorization methods are available?
Options include IAM/SigV4, Cognito user pools, JWT, OIDC, OAuth 2.0, Lambda authorizers, API keys, and mutual TLS.
What AWS services and backends can it connect to?
Listed integrations include Lambda, Step Functions, Elastic Beanstalk, EC2, and publicly accessible HTTP endpoints. HTTP APIs can also route to services behind private load balancers and IP-based services registered in AWS Cloud Map.
Who makes Amazon API Gateway?
Amazon Web Services says it launched API Gateway in 2006.
