API Authentication via API Keys | AWS API Gateway

[@grassrootsdefi7522]

Felix, well done. Your presentation is clear, concise, and we can feel you at your ease. A+

[@FelixYu]

glad that it helped :)

[@blackboy424]

damn usage plan portion had me stuck for an hour today! Thanks for the video o

[@BroGu]

No wonder. I didn't realize I needed to set up an usage plan. Although the documentation does have this section under "distribution", I didn't think about setting it up during the development phase. Thank you very much for your video!

[@FelixYu]

Glad that u found it helpful!!

[@ColdFireInBox]

Great tutorial Felix. This is what I was looking for

[@AnilAnil-zu4qm]

Wow what a explaination. You got a subscriber. Thanks dude.

[@joshb.9380]

Thanks for making this follow-up video. Very helpful!

[@albert_the_project]

Great tutorial. Very clear all steps.

[@FelixYu]

Glad that u found it helpful!!

[@JordiVicensFarrus]

Love your videos, thanks for giving me a better idea of how AWS works.

[@FelixYu]

Glad that u found them helpful :)

[@Fabrimanga89]

Hi Felix, thanks for the video, very helpful. One question, say I have 100 different endpoints with a GET and POST method for each. What's the best way to apply the API key to each Method Request? Using the SDK? Doing it manually one by one is not feasible for big apps.

[@brucevwilcox1002]

Very helpful. Thanks for producing this.

[@FelixYu]

Glad that u found it helpful!!

[@meenu2511]

Thanks bro, simple and short.

[@mario17-t34]

Thanks much, is x-api-key is a reserved word ?

[@SamuelCarreira]

Nice tutorial, there’s a way to get the number of request left for that API key? Example, define a quota of 100 API calls per month and sends to the user how many he has left Thanks

[@danielhalmstrand2123]

Thank you Felix for a great tutorial....

[@FelixYu]

Glad that it’s helpful

[@ssthil1]

It really helped, thanks for it, appreciated! 👍

[@bjblk1]

Felix, awesome video. Thank you very much.

[@FelixYu]

Glad that u found it helpful!!

[@CMDying]

Great work. Really well details video - Thanks for this.

[@FelixYu]

glad that u found it helpful 👍

[@webpro9083]

Hello, thanks for the turorial. Is there a way to create the client API key using aws SDK?

[@rcdag-b5z]

thank you so much, it helped me a lot this video!

[@richardq16]

Awesome!! how can you hide the key when invoking the service from the front? because it appears when I inspect the page.

[@akultomar7328]

Did you figure this out?

[@AmanBhangu]

Thanks a lot Felix!

[@janivimal]

10/10

[@debasishchakraborty7526]

nice presentation. now, how could I add this API-key to my code? And if I do (for example App.js using React) then doesn't this key will be exposed? Sorry, it might be a very naive one. I am quite new to aws.

[@nicanormedina6900]

You are god. Thanks.

[@FelixYu]

Tyty glad that u found it helpful!!

[@christianechica4270]

During patch or delete you will get "message": "Missing Authentication Token

[@akultomar7328]

@Felix Yu Is there a way I can restrict unknown bot clients if the bot creator copies the x-api-key value from their browser and use it in the shell script and invoke api gateway via cURL?

[@한진영-o5q]

Hey , I am making a phone number locator. I used OpenCageData for API key. The program i am making is just a file on my computer, I am not intending to use it on any website or anything. Do I have to encrypt or restrict the API key? and another question, I am not finding any way to restrict in OpenCage like in Google. (A subscription is needed to do that.) I am using Latitude and Longitude coordinates for locating on the maps. Can I use Google cloud services instead of OpenCage for that?

[@VarunKumar-ql6zn]

Thanks

[@valirjonathan2161]

Nice. Can you do an TODO app with user registration and login with API Gateway and DynamoDB?

[@FelixYu]

Thank you for the suggestions. I’ll certainly look into it!!!!

[@valirjonathan2161]

@@FelixYu Great. I have been looking for a tutorial with a authentication and authorization before users can do something with the app. Looking forwards to it.

[@navjotsingh2457]

ty

[@DouglasGouveia]

In my test error message: "Missing Authentication Token

[@FelixYu]

did u deploy the API to a stage (new or existing one)

[@rolandochew8399]

What happend if we have an Apikey by Secrets Manager, how we can test it?

[@jjs1079]

Thanks for the great tutorials! I followed your tutorials and managed to host my frontend app in cloudFront(with S3) and created api gateway using lambda. Last task is fetching data from the endpoint from my app. I wondering if there is a way to hide api key in the frontend app? Having api key seems safe to use in postman but I can't think a way to hide it in the app🤔

[@FelixYu]

Thats a great question. i dont think we should store api keys in the frontend (not even the .env file) becuz it will go into the build files and users can see everything from the browser. i think the best way to handle that may be having 2 separate api's. one api handles the authentication (i.e., users sign in), which doesnt require an api key cuz anyone can try to log in from the web page. and then after a successful login, this api will call a second api (using an api key) to fetch data from the database and serve it back to the client. i have a separate video that talks abt authentication in react. note that i think i used an api directly in the frontend there. thats is for tutorial/demo purposes only. we shouldnt do that in production kzbin.info/www/bejne/iJaxnIRmjdCWmdk

[@akultomar7328]

@@FelixYu Is there a way I can restrict unknown bot clients if the bot creator copies the x-api-key value from their browser and use it in the shell script and invoke api gateway via cURL?

[@Control433]

Hi, I have a question how do I use the API key in my code? I understand how to access the API in postman, but if I want to push json data to my front end where do i put the header information?

[@FelixYu]

i have a diff video that talks abt how to integrate that into the frontend. make sure u check out part 1 as well so u know how to enable cross site access kzbin.info/www/bejne/iJaxnIRmjdCWmdk

[@Control433]

​@@FelixYu What if I want to do it in the backend though? The front end isn't safe because I'm trying to make a public facing application. Basically, I don't know how to pass an http header parameter (the api key) through Javascript. Sorry, if I'm asking too many questions. Your videos are awesome!

[@arefinhossain9758]

Thanks a lot

[@FelixYu]

Glad that it’s helpful 👍

[@elClubdelas7Cifras]

done

[@santiago.m.l]

Que afan de ponerle anuncions a todos los videos existentes..

[@buituandung4554]

5:28