When should I use API Gateway vs. just exposing services directly?

Use API Gateway when you need: authentication management, request/response transformation, throttling, API versioning, or aggregated monitoring across many services. For a single internal service with no external exposure, direct routing through an SLB or directly to ECS is simpler and cheaper. API Gateway shines for public APIs and partner integrations.

What authentication methods does API Gateway support?

App Key/Secret (HMAC signing), JWT, OpenID Connect, and 'open' (no auth, public endpoint). For partner-facing APIs, App Key/Secret is the most common pattern. For end-user-facing APIs that already have a JWT-issuing identity provider, JWT validation lets you reuse the existing identity infrastructure.

Alibaba API Gateway Config Builder

ServerlessAlibaba Cloud

Build API Gateway configurations with API definitions, authentication, throttling, and backend routing.

Last verified: May 2026

Alibaba Cloud API Gateway Configuration

Build API Gateway configurations with API definitions, authentication, throttling, backend routing, and custom domains.

Required Fields

groupNameapis

{
  "groupName": "prod-order-api",
  "description": "Order management API gateway group",
  "instanceType": "VPC_SHARED",
  "apis": [
    {
      "apiName": "CreateOrder",
      "method": "POST",
      "path": "/v1/orders",
      "authType": "APP",
      "serviceType": "FunctionCompute",
      "serviceConfig": {
        "fcRegion": "cn-hangzhou",
        "serviceName": "order-service",
        "functionName": "createOrder",
        "qualifier": "LATEST"
      },
      "requestParameters": [
        {
          "name": "Content-Type",
          "location": "HEAD",
          "required": true,
          "defaultValue": "application/json"
        }
      ],
      "throttling": {
        "apiDefault": 1000,
        "appDefault": 200,
        "userDefault": 100
      }
    },
    {
      "apiName": "GetOrder",
      "method": "GET",
      "path": "/v1/orders/[orderId]",
      "authType": "APP",
      "serviceType": "HTTP",
      "serviceConfig": {
        "address": "http://order-backend.internal:8080",
        "path": "/api/orders/[orderId]",
        "method": "GET"
      },
      "cacheTTL": 60
    }
  ],
  "customDomain": {
    "domainName": "api.example.com",
    "certificateId": "cert-bp1****"
  },
  "plugins": [
    {
      "pluginType": "cors",
      "config": {
        "allowOrigins": "https://app.example.com",
        "allowMethods": "GET,POST,PUT,DELETE",
        "allowHeaders": "Authorization,Content-Type",
        "maxAge": 3600
      }
    }
  ]
}

Generated Output

Output will appear here...

See It in Action

Your team has built three microservices and wants to expose them as a unified public API with proper authentication and throttling. You define the API in the builder with authentication, throttling per app, and routing to each service's backend. Partners get App Keys and signed-request access; the gateway enforces rate limits centrally; observability for all three services flows through one dashboard.

What This Tool Does

Alibaba Cloud API Gateway is the managed API management layer, define APIs, attach authentication, configure throttling, route to backends (Function Compute, ECS, HTTP). The API Gateway Config Builder generates complete API configurations including definitions, authentication, throttling policies, and backend routing. Output is Terraform-ready and matches `alicloud_api_gateway_api`.

Technical Details

The builder collects API name, group, request path/method, request parameters, backend type (Function Compute, HTTP, mock), authentication, throttling policy, and visibility (public or private). It validates the configuration against API Gateway's expected schema and emits `alicloud_api_gateway_group`, `alicloud_api_gateway_api`, and associated Terraform resources.

Common Use Cases

1Defining a new API with multiple endpoints routing to Function Compute backends, with authentication and throttling.
2Adding an HMAC-authenticated endpoint to an existing API for a partner integration.
3Configuring throttling policies that limit per-app or per-API request rates.
4Migrating a self-managed nginx-based API gateway to Alibaba Cloud API Gateway for the management benefits.

Common Questions

When should I use API Gateway vs. just exposing services directly?: Use API Gateway when you need: authentication management, request/response transformation, throttling, API versioning, or aggregated monitoring across many services. For a single internal service with no external exposure, direct routing through an SLB or directly to ECS is simpler and cheaper. API Gateway shines for public APIs and partner integrations.
What authentication methods does API Gateway support?: App Key/Secret (HMAC signing), JWT, OpenID Connect, and 'open' (no auth, public endpoint). For partner-facing APIs, App Key/Secret is the most common pattern. For end-user-facing APIs that already have a JWT-issuing identity provider, JWT validation lets you reuse the existing identity infrastructure.

Expert Tips

TIP

Always set per-API throttling. Without it, a runaway client or malicious actor can consume your entire backend capacity. Per-app and per-API throttling defends against both runaway integrations and intentional abuse.

TIP

Use API stages (test, prerelease, release) to roll out changes safely. Promote configurations stage-by-stage and verify before traffic flows through.

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.