What Is Amazon API Gateway? APIs in Plain English

Amazon API Gateway is the front door of a serverless app: it takes requests from the internet — a browser, a phone app, another company's server — checks them in, and hands them to your code (usually AWS Lambda) or your data. Your code never faces the internet directly; the Gateway does, and it handles the unglamorous door work — who gets in, how often, and for how long. And here is the fact this page is built around, straight from AWS's own pricing sheet: API Gateway is really two nearly-identical products, and one costs 3.5× more than the other. "REST APIs" run $3.50 per million requests; "HTTP APIs" do the same core job for $1.00 per million — and because REST is the older flavor, it is the one most tutorials still teach. Thousands of people overpay 3.5× not because they chose to, but because they followed a guide written before the cheap one existed.

Jake got pulled into this one by a customer's son — a college student whose class project "randomly failed." His Lambda function generated PDF reports: small reports worked every time, big ones failed every time, and the error said nothing useful. Jake is a hardware man, but he knows a pattern when he sees one, and this pattern had a number in it: the son timed the failures, and every single one died at exactly 29 seconds. Nothing random fails at exactly the same second. One search later they had it: API Gateway's default integration timeout — the front door hangs up on your code at 29 seconds, even though the code itself is allowed to keep running. The Lambda was finishing the big reports beautifully, at second forty, for an audience of nobody.

Ethan: "It's a receptionist. Visitors don't wander your office — they state their business at the desk, get checked in, and get walked to the right room. The receptionist also does the things you'd never ask the engineers to do: turns away the guy who's visited 400 times this minute, and — this is the part that bites — tells every caller 'I'm going to hang up in 29 seconds whether you're done or not.' Great employee. Read the contract."

Why your code needs a front door at all

In the last two stops of this series, we built the working parts: Lambda runs your code without a server, and DynamoDB stores your data without a database machine. But neither is built to face the raw internet on its own. Someone has to answer questions like: Is this visitor allowed in? Is this the login route or the payment route? Is one angry script hammering us a thousand times a second? Should this response be remembered instead of recomputed? That someone is API Gateway. It publishes a clean public URL, splits it into routes (/users, /orders, /login), attaches each route to a Lambda function or another AWS service, and stands guard over all of it. Like everything in this series, the theme is the same: AWS runs the machinery, you write the rules, and there is no gateway server for you to patch at 2 am.

The honest question first: Lambda has free URLs — do you even need this?

A fair question, and most guides skip it. Lambda offers Function URLs — a bare, free web address bolted straight onto one function, no Gateway involved. For a personal experiment with one function and no secrets, that is genuinely enough, and we would rather tell you that than sell you an extra service. You graduate to API Gateway when any of these become true: you have multiple routes that should live under one address; you need real sign-in checks at the door instead of inside your code; you want throttling so a viral moment or a hostile script cannot run up your bill; you need API keys to give partners measured access; you want caching, custom domains, or request validation. In other words: a Function URL is a doorbell on a shed. API Gateway is a staffed lobby. Sheds are fine — until you store something valuable in one.

The three flavors — and the 3.5× decision

The naming is the trap, so let's disarm it: both HTTP APIs and REST APIs serve "REST-style" requests. The names describe product generations, not protocols. REST API is the 2015 original with every bell and whistle; HTTP API is the 2019 rebuild — leaner, faster, and 71% cheaper — that covers what the large majority of apps actually use. AWS's own pricing page states the gap plainly: $3.50 versus $1.00 per million on the first tier. Old tutorials default to REST because it was the only option when they were written. Your default should be the opposite: start with HTTP APIs, and upgrade to REST only when a specific feature — API keys for partners, response caching, strict request validation, private-network-only APIs — forces your hand.

The 29-second rule (the trap from Jake's story)

By default, API Gateway waits 29 seconds for your backend to answer, then returns an error to the caller — even if your Lambda is mid-sentence and even though Lambda itself can legally run for up to 15 minutes. The mismatch is deliberate: a front door that lets strangers hold a line open for minutes is a front door that can be abused. But it produces exactly the ghost bug from the intro: code that works on small jobs and "randomly" dies on big ones, always at the same second. Two honest escapes exist. The architectural one (usually right): stop making the visitor wait — accept the request, return "working on it" immediately, run the long job asynchronously, deliver the result when it is done. The direct one (newer): since June 2024, AWS lets you raise the integration timeout beyond 29 seconds — up to 5 minutes — on Regional and private REST APIs, via a Service Quotas request, with a possible trade-off in your account's throttling limit. It is a genuine escape hatch for slow third-party calls; it is not a license to keep users staring at spinners.

Throttling: the bodyguard your AWS bill never knew it had

Back in the billing stop of this series, we told you the uncomfortable truth that AWS has no spending cap — nothing built-in that stops a runaway bill. API Gateway is one of the few places you can actually install a brake. Throttling limits how many requests per second your API will accept; anything beyond gets a polite 429 Too Many Requests instead of reaching your Lambda and your DynamoDB — which means a viral link, a misbehaving partner script, or a bored attacker hits a wall before the part of your stack that costs money per invocation. You can set these limits per stage and, on REST APIs with usage plans, per customer key. If you run any public serverless API, configuring a sane throttle is the single cheapest insurance in this series: the front door bouncing freeloaders is always cheaper than the kitchen feeding them. Setting one takes a minute:

1. Open your API in the API Gateway console and pick the deployed stage (e.g. prod).
2. Find the Throttling settings for the stage (HTTP APIs: under the stage's default route settings; REST APIs: on the stage editor).
3. Set a rate (steady requests per second) and burst (short spikes) that match reality — a hobby app is comfortable at 10–50 rps, not the generous defaults.
4. Save. Anything past the limit now gets a 429 at the door instead of a bill in your inbox.

The picture so far: a complete app with no servers in it

Notice what this series has quietly assembled. A browser calls a URL → API Gateway checks the visitor in and picks the route → Lambda wakes, runs your logic, and goes back to sleep → DynamoDB reads or writes the data → the answer walks back out the front door. That is a real, production-grade application — login checks, traffic control, code, database — and there is not one server in it that you patch, restart, or pay for while it idles. At small scale it runs close to free: a million front-door requests cost $1, a million Lambda invocations sit inside the always-free tier, and DynamoDB's on-demand pricing bills fractions of a cent. This is the architecture behind an enormous share of modern startups' first versions, and you now understand every box in the diagram.

What it costs, in real numbers

The free lane, dated August 21, 2026 so you can check it against the future: the classic 12-month free tier includes one million API calls a month (HTTP and REST each, plus a WebSocket allowance), and accounts created after July 15, 2025 instead get the newer deal from our billing post — up to $200 in credits with an optional six-month free plan that, as we covered there, closes the account rather than billing you when it ends. Either way, learning API Gateway costs nothing. Volume discounts exist too — both flavors get cheaper past a few hundred million requests — but by then you have revenue and this table is your accountant's problem.

Try it in ten minutes, free

1. In the AWS console, create a Lambda function from the "hello world" blueprint (the Lambda post walks this).
2. Open API Gateway → Create API → HTTP API → Build. Add your Lambda as the integration.
3. Accept the default route and stage, create, and copy the Invoke URL it hands you.
4. Paste that URL in your browser. Your code answers from the cloud, through its new front door.
5. Before you close the tab: open the stage's Throttling settings and glance at the defaults — now you know where the brake pedal is.

FAQ — API Gateway in plain English

What is Amazon API Gateway in one sentence?

A managed front door that receives internet requests, checks them in, and routes them to your AWS code or data — handling security, traffic limits, and timeouts so your code doesn't have to.

What is the difference between an HTTP API and a REST API?

Product generations, not protocols — both serve normal web requests. REST API (2015) has every feature: keys, usage plans, caching, validation. HTTP API (2019) is the lean rebuild at $1.00 versus $3.50 per million. Start with HTTP.

Is API Gateway free to learn on?

Yes. The 12-month free tier includes one million calls a month, and post-July-2025 accounts get the $200-credit free plan instead. A tutorial's worth of clicking costs nothing either way.

What is the 29-second timeout?

API Gateway's default patience: if your backend hasn't answered in 29 seconds, the caller gets an error — even though Lambda can run 15 minutes. Failures at exactly 29 seconds are this, every time.

Can the 29-second limit be raised?

Since June 2024, yes — up to 5 minutes on Regional and private REST APIs, requested through Service Quotas, possibly trading away some account throttle capacity. The better fix for long jobs is usually async design.

Do I need API Gateway if Lambda has Function URLs?

Not always — a single function with no secrets does fine on a free Function URL. You need the Gateway when you want multiple routes, sign-in at the door, throttling, API keys, caching, or a custom domain.

What does a 429 error from my API mean?

Throttling working as intended: the caller exceeded the requests-per-second limit and got "Too Many Requests" instead of reaching your code. Check whether the limit or the caller is the problem.

Does API Gateway protect my AWS bill?

Throttling is one of the few real brakes in AWS: excess requests are rejected at the door before they invoke Lambda or hit DynamoDB. It caps the blast radius of viral traffic and hostile scripts.

What is a WebSocket API for?

Apps where the server pushes to the browser without being asked — chat, live dashboards, multiplayer games. Priced per message and per connection-minute instead of per request.

Can API Gateway talk to things other than Lambda?

Yes — it can front other AWS services and any HTTP backend, including servers outside AWS. Lambda is simply the most common partner in serverless designs.

What are API keys and usage plans?

REST-API features for measured access: give each partner a key, attach limits and quotas per key, and see who used what. It is how "1,000 free calls a day, then paid" products are built.

Does API Gateway handle login and authentication?

At the door, yes — it can validate JWT tokens (HTTP APIs), call a custom authorizer Lambda, or use IAM permissions from earlier in this series, all before your business code runs.

What is caching in API Gateway?

A REST-API option that remembers responses for a set time, answering repeat requests without invoking your backend — billed hourly by cache size. Great for read-heavy endpoints whose answers rarely change.

Is API Gateway a server I have to manage?

No — that is the point. AWS runs, scales, and patches the door. You configure routes and rules; there is nothing to SSH into, which by now is this series' oldest running theme.

How does data transfer pricing work?

Responses leaving AWS cost $0.09/GB on top of request pricing — the same quiet line item our billing post warned about. Small JSON answers make it pennies; streaming files through an API makes it real money.

Where does this series go next?

The waiting line: Amazon SQS — the queue that lets the front desk accept work instantly and lets the kitchen cook at its own pace. It is the missing piece behind the async answer to the 29-second rule.

Where to go next

A note on this post. Written August 21, 2026, with every price checked against AWS's own pricing pages that day — $1.00 and $3.50 per million will drift someday, but the 3.5× lesson and the 29-second rule are the durable parts. This is stop eight of our learn-AWS-for-free series (S3 → EC2 → EBS → IAM → billing → Lambda → DynamoDB → the front door), and the DynamoDB post promised you this one — promise kept. Next stop, as promised above: Amazon SQS, the waiting line. If a price has moved or a claim has aged, tell me through the contact page and I will fix it — that is a standing offer on every post here. See you at the queue.