GCP for DevOps — API Gateway

API Gateway

API Gateway is a fully managed service for creating, securing, and monitoring APIs. It sits in front of Cloud Run, Cloud Functions, or App Engine backends and provides authentication, rate limiting, and OpenAPI-based routing.

How It Works

┌──────────────────────────────────────────────────┐
│              API Gateway Architecture             │
├──────────────────────────────────────────────────┤
│                                                   │
│  Client                                           │
│    │                                              │
│    ▼                                              │
│  ┌──────────────┐                                │
│  │ API Gateway  │  OpenAPI spec defines routes    │
│  │              │  Auth, rate limiting, logging    │
│  └──────┬───────┘                                │
│         │                                         │
│    ┌────┼────────────┐                            │
│    ▼    ▼            ▼                            │
│  ┌────┐ ┌──────┐ ┌──────────┐                   │
│  │ CF │ │Cloud │ │App Engine│                    │
│  │    │ │Run   │ │          │                    │
│  └────┘ └──────┘ └──────────┘                   │
└──────────────────────────────────────────────────┘

Create an API with OpenAPI Spec

# openapi-spec.yaml
swagger: "2.0"
info:
  title: "My API"
  version: "1.0.0"
host: "my-api-gateway-abc123.apigateway.my-project.cloud.goog"
schemes:
  - "https"
paths:
  /users:
    get:
      summary: "List users"
      operationId: "listUsers"
      x-google-backend:
        address: "https://users-service-abc123-uc.a.run.app/users"
      responses:
        "200":
          description: "OK"
  /orders:
    get:
      summary: "List orders"
      operationId: "listOrders"
      x-google-backend:
        address: "https://orders-service-abc123-uc.a.run.app/orders"
      responses:
        "200":
          description: "OK"
    post:
      summary: "Create order"
      operationId: "createOrder"
      x-google-backend:
        address: "https://orders-service-abc123-uc.a.run.app/orders"
      responses:
        "201":
          description: "Created"

Deploy the API Gateway

# Step 1: Create an API
$ gcloud api-gateway apis create my-api \
    --project=my-project

# Step 2: Create an API config from the OpenAPI spec
$ gcloud api-gateway api-configs create my-api-config-v1 \
    --api=my-api \
    --openapi-spec=openapi-spec.yaml \
    --project=my-project

# Step 3: Create a gateway
$ gcloud api-gateway gateways create my-gateway \
    --api=my-api \
    --api-config=my-api-config-v1 \
    --location=us-central1 \
    --project=my-project

# Get the gateway URL
$ gcloud api-gateway gateways describe my-gateway \
    --location=us-central1 \
    --format="value(defaultHostname)"

my-gateway-abc123.apigateway.my-project.cloud.goog

# Test
$ curl https://my-gateway-abc123.apigateway.my-project.cloud.goog/users

Authentication with API Key

# openapi-spec.yaml — add API key security
swagger: "2.0"
info:
  title: "My API"
  version: "1.0.0"
securityDefinitions:
  api_key:
    type: "apiKey"
    name: "x-api-key"
    in: "header"
security:
  - api_key: []
paths:
  /users:
    get:
      operationId: "listUsers"
      x-google-backend:
        address: "https://users-service-abc123-uc.a.run.app/users"
      responses:
        "200":
          description: "OK"

# Create an API key
$ gcloud services api-keys create \
    --display-name="Client API Key" \
    --api-target=service=my-api-abc123.apigateway.my-project.cloud.goog

# Use the key
$ curl -H "x-api-key: AIza..." \
    https://my-gateway-abc123.apigateway.my-project.cloud.goog/users

Authentication with JWT (Firebase/Google)

securityDefinitions:
  google_id_token:
    authorizationUrl: ""
    flow: "implicit"
    type: "oauth2"
    x-google-issuer: "https://accounts.google.com"
    x-google-audiences: "my-project.apps.googleusercontent.com"
    x-google-jwks_uri: "https://www.googleapis.com/oauth2/v3/certs"
security:
  - google_id_token: []

Update API Configuration

# Deploy a new API config version
$ gcloud api-gateway api-configs create my-api-config-v2 \
    --api=my-api \
    --openapi-spec=openapi-spec-v2.yaml

# Update the gateway to use the new config
$ gcloud api-gateway gateways update my-gateway \
    --api=my-api \
    --api-config=my-api-config-v2 \
    --location=us-central1

Common Mistakes

Mistake	Why It’s Wrong	Fix
No authentication	API exposed to everyone	Add API key or JWT security
Backend without IAM	Gateway can’t reach backend	Grant invoker role to gateway SA
Hardcoding backend URLs	Breaks across environments	Use substitution or per-env specs
No rate limiting	Abuse/cost risk	Configure quotas in API config
Not versioning API configs	Can’t rollback	Use versioned config names

Quick Reference

Command	Description
gcloud api-gateway apis create A	Create API
gcloud api-gateway api-configs create C --openapi-spec=F	Create config
gcloud api-gateway gateways create G --api=A --api-config=C	Create gateway
gcloud api-gateway gateways update G --api-config=C2	Update config
gcloud api-gateway gateways describe G	Get gateway URL

Next → Firestore