This blog explains how to build an API Gateway REST API that temporarily accepts API keys as query string parameters.
he post also discusses increasing security by refactoring the client to send API keys as a header instead of a query string.
API Gateway only accepts requests over HTTPS, which means that the request is encrypted. When sending API keys as query string parameters, there is still a risk that URLs are logged in plaintext by the client sending requests.
API Gateway has two settings to accept API keys:
- Header: The request contains the values as the X-API-Key header. API Gateway then validates the key against a usage plan.
- Authorizer: The authorizer includes the API key as part of the authorization response. Once API Gateway receives the API key as part of the response, it validates it against a usage plan.
In addition to security, there is also a cost factor. Each time the client request contains an API key, the custom authorizer AWS Lambda function will be invoked, increasing the total amount of Lambda invocations you are billed for