Serverless
Intermediate 13 min read Serverless

Serverless APIs & API Gateways

Expose functions as URLs with guardrails

Gateways turn functions into HTTP endpoints: routing, auth, throttling, validation, and caching at the front door. Lambda + API Gateway, Azure Functions hosting plan, and Cloud Run behind Global External are the same design, different panels.

API GatewayintegrationAuththrottlingrequest validationproxy
Prerequisites: FaaS & Cloud Functions
Before we start

What you will learn

  • Wire a function to an HTTP route with path/query mapping
  • Apply authN/authZ and throttling at the gateway
  • Debug 4xx/5xx between client, gateway, and function
In 60 seconds

A gateway fronts routes → integrations. For serverless, use proxy mode: route → function passthrough, gateway adds auth/OAuth, throttling, validation, and WAF. Panels: API Gateway (REST/HTTP/WebSocket), Azure API Management/Functions routing, Cloud Run URL + API Gateways.

Introduction

What is this?

Route types: REST, HTTP, WebSocket (AWS), Function App host (Azure), Cloud Run URL/logical config. Integration types: proxy (forward whole request) vs passthrough templates. Security: API keys, SigV4, OAuth/JWT check (authorizer), custom authorizer Lambda; Azure Key Vault-managed; Cloud IAM + Google API Gateway. Guardrails: throttling (request/second), burst, quotas, per-route; request validation (headers/querystring/body schema) returns 4xx before invoke. Pricing: requests + data transfer; caching per stage.

Motivation

Why do you need it?

  • The gateway standardizes auth, rate limits, and TLS across many functions.
  • Serverless APIs inherit elasticity: gateway + function scale with no fleet to manage.
  • Throttling protects your back-end from blast-radius or abusive clients.
  • Central observability: one layer you log metrics from, correlated by request-id.
Think about it

Mental model

Imagine

Reception signing visitors in by pass and appointment

Think of

API gateway before serverless APIs

The desk checks your badge (auth), limits crowd bursts (throttling), verifies your form (validation), then pages the correct employee (routes to the function).

Mechanics

How it works

  • Client calls gateway URL with method/path/headers.
  • Gateway authorizes (key/JWT/custom), throttles, validates.
  • Proxy integration forwards the normalized event to the function.
  • Function returns result; gateway maps to the HTTP response (CORS/status).
  • Metrics per route; errors map to 4xx (client) or 5xx (provider/function).

Gateway in front of functions.

Client
AuthN/Z
Throttle + validate
Function
Response
Hands-on

Examples

OpenAPI mapping for a function (REST/HTTP API v2)

OpenAPI mapping for a function (REST/HTTP API v2)
openapi: 3.0.1
info: { title: profiler, version: "1.0" }
paths:
  /profile/{id}:
    get:
      x-amazon-apigateway-integration:
        type: aws_proxy
        httpMethod: POST
        uri: arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:...:function:get-profile/invocations
    security:
      - Auth: []

Proxy integration maps every HTTP request onto one function invocation; the gateway keeps doing auth + throttling around it.

Real world

In production

  • Public REST APIs rate-limited per API key, JWT-gated, WAF-protected.
  • WebSocket chat backed by a connection-store + stream function.
  • Internal BFFs: the gateway normalizes payloads, strips internal fields.
  • Multi-tenant SaaS: per-client API keys, quotas, and cached responses.
Guidelines

Best practices

  • Prefer proxy integrations; avoid brittle path/body templates.
  • Write validation at the gateway; keep business ID parsing in the handler.
  • Gate every route with auth unless explicitly public; fail closed.
  • Set per-route throttling and stage quota to stop edge cases from becoming outages.
  • Log request-id at client + function for cross-cutting traceability.
Watch out

Common mistakes

  • Hand-rolling auth in every function instead of one gateway authorizer.
  • A gateway that passes through unrestricted body size/key abuse to functions.
  • No stage-level throttles, so a spike in one route starves all others.
  • CORS misconfig hiding real errors behind misleading browser failures.
When things break

Debugging tips

  • Client sees 403 → check authorizer and API-key/header mapping first.
  • Function times out but gateway p50 fine → integration timeout vs function timeout mismatch.
  • Compare gateway execution logs and function logs for the same request-id.
  • Use stage variables/env to swap endpoints without code releases.
Interviews

Interview checkpoint

Test yourself

Quick quiz

0/2
1

Gateway throttling primarily protects:

2

An authorizer that returns 401 should map to:

Go deeper

Official documentation

Amazon API Gateway
docs
Google API Gateway
docs
Azure Functions bindings
docs