Chapter 3. APIcast hosted
Once you complete this tutorial, you will have your API fully protected by a secure gateway in the cloud.
APIcast hosted is the best deployment option if you want to launch your API as fast as possible, or if you want to make the minimum infrastructure changes on your side.
Prerequisites
- You have reviewed Chapter 3, APIcast hosted for deployment alternatives and decided to use APIcast hosted to integrate your API with 3scale.
- Your API backend service is accessible over the public Internet. Secure communication will be established to prevent users from bypassing the access control gateway.
- You do not expect demand for your API to exceed the limit of 50,000 hits/day. Beyond beyond this, we recommend upgrading to the self-managed gateway.
- Section 3.1, “Deploying your API with APIcast hosted in a staging environment”
- Section 3.2, “Deploying your API with the APIcast hosted into production”
3.1. Deploying your API with APIcast hosted in a staging environment
The first step is to configure your API and test it in your staging environment:
Procedure
- Define the private base URL and its endpoints.
- Choose the placement of credentials and other configuration details. For more information see the APIcast Hosted documentation.
- Save the configuration settings by clicking Update Product. These settings go through the APIcast staging instance to your API.
You will see a green confirmation message when your configuration is complete.
Before moving on to the next step, make sure that you have configured a secret token to that you backend service validates. You can define the value for the secret token under Authentication Settings. This will ensure that nobody can bypass APIcast access control.
3.2. Deploying your API with the APIcast hosted into production
At this point, you are ready to take your API configuration to a production environment. To deploy your 3scale Hosted APIcast instance:
Procedure
- Go back to the Integration and Configuration page and click on the 'Promote to v.x to Production' button.
- Repeat this step to promote further changes in your staging environment to your production environment.
It will take between 5 and 7 minutes for your configuration to deploy and propagate to all the cloud APIcast instances. During redeployment, your API will not experience any downtime. API calls may return different responses depending on which instance serves the call. Deployment has been successful when the box around your production environment has turned green.
Both the staging and production APIcast instances have base URLs on the apicast.io
domain. You can tell them apart because the staging environment URLs have a staging subdomain. For example:
- staging: https://api-2445581448324.staging.apicast.io:443
- production: https://api-2445581448324.apicast.io:443
3.3. Additional information
- 50,000 hits/day is the maximum allowed for your API through the APIcast production cloud instance. You can check your API usage in the Analytics section of your Admin Portal.
- There is a hard throttle limit of 20 hits/second on any spike in API traffic.
-
Above the throttle limit, APIcast returns a response code of
403
. This is the same as the default for an application over rate limits. If you want to differentiate the errors, please check the response body.