Amazon API Gateway consulting for safer APIs

Amazon API Gateway is the AWS service that sits in front of your backend and handles incoming API calls. It routes each request to Lambda, a container, an HTTP endpoint or another AWS service, checks who is calling, applies rate limits and logs every call. Teams use it for app backends, partner APIs, SaaS webhooks like Zoho CRM, and WebSocket apps.

HTTP APIs are the newer, simpler and cheaper option at $1.00 per million requests in US East (N. Virginia), with JWT and Lambda authorizers and direct links to services like SQS. REST APIs cost $3.50 per million calls for the first 333 million but add API keys with usage plans, response caching, AWS WAF, request validation and mock responses. We pick per API, and sometimes run both.

In US East (N. Virginia) HTTP APIs are $1.00 per million requests for the first 300 million a month, REST APIs are $3.50 per million for the first 333 million, and WebSocket APIs are $1.00 per million messages plus $0.25 per million connection minutes. Data transfer out is billed at EC2 rates, and REST caching is billed per hour by cache size.

API Gateway suits APIs that need per-route auth, rate limits, API keys or a serverless backend, and traffic that comes in bursts. An Application Load Balancer is often cheaper for heavy, steady traffic to containers or EC2, since it bills by the hour and capacity unit rather than per request. Some setups use both, with the load balancer behind a private API Gateway integration.

We add a shared secret to the Zoho CRM webhook as a custom header or parameter, then check it with a Lambda authorizer that reads the secret from AWS Secrets Manager and caches the result. Requests without it get a 401 or 403 and never reach your code. We also set throttles on the route and keep access logs in CloudWatch.

REST API integrations have a 29-second timeout by default, which can be raised for Regional and private REST APIs through a quota request. HTTP API integrations can run for up to 30 seconds. Anything slower, like a big export, should accept the request, put the job on a queue and let the caller check back.

A 429 means a throttle limit was hit. API Gateway uses a token bucket per account and Region, with default quotas AWS publishes for each Region, plus any stage, route or usage plan limits you set. We size those limits to real traffic, ask AWS for quota increases when needed, and make callers like Zoho retry with backoff.

Yes. HTTP APIs have first-class integrations for SQS, EventBridge, Kinesis Data Streams, Step Functions and AppConfig, and REST APIs can call most AWS service actions through an AWS integration. Sending webhooks straight into SQS is one of our favorite patterns, because it removes code and never loses a message during a deploy.

If the logic is small and works mostly on Zoho data, Zoho Catalyst can be simpler, since it has its own functions and gateway next to your Zoho apps. If your product, database or other services already run on AWS, API Gateway with Lambda keeps everything in one account. We are a Zoho Catalyst Partner and an AWS Partner, so we recommend whichever fits.

Our first call about your API costs nothing. After that, the routes, security, tests and cutover are written into a signed BRD at a fixed price with a delivery schedule. AWS bills you directly for API Gateway and anything behind it.