AWS First Steps
Serverless

Amazon API Gateway Design Patterns - Choosing Between REST API and HTTP API

Clear criteria for choosing between HTTP API and REST API, authentication patterns with Cognito and Lambda authorizers, and practical throttling design techniques.

About 5 min readWritten and edited by Awashiro

Criteria for Choosing Between REST API and HTTP API

API Gateway offers two types: REST API and HTTP API. HTTP API, released in preview in December 2019 and made generally available in March 2020, covers the core features of REST API while being up to 71% cheaper with lower latency. If your primary use case is proxying to Lambda functions or HTTP endpoints, HTTP API is the right choice. Cases where you should choose REST API include: publishing APIs to third parties with API keys and usage plans, request/response transformation (mapping templates), WAF integration, edge-optimized endpoints, and request validation features. For new projects, the recommended approach is to default to HTTP API and only consider REST API when you need features that HTTP API doesn't offer.

Authentication and Authorization Patterns

API Gateway supports multiple authentication methods, but the types of authorizers available differ between REST API and HTTP API (as of August 2026). The Cognito user pool authorizer (COGNITO_USER_POOLS) is specific to REST API: API Gateway automatically validates the JWT tokens issued by Cognito. Since you don't need to implement token validation logic yourself, it is easy to adopt in configurations that use Cognito. HTTP API does not offer this authorizer; instead, you use a JWT authorizer. A JWT authorizer validates JWTs in line with the OpenID Connect (OIDC) and OAuth 2.0 frameworks, using a specified issuer and audience. Because a Cognito user pool can be specified as the issuer, Cognito-based authentication is still achievable with HTTP API, but note that the type of authorizer you configure is different. The JWT authorizer verifies the signature with the public keys retrieved from the issuer's jwks_uri (only RSA-based algorithms are supported) and evaluates claims such as iss, aud, and exp. If you configure authorization scopes per route, you can also control access based on the scopes contained in the token. Lambda authorizers let you implement custom authentication logic in a Lambda function. Use them when you need flexible authorization logic such as custom token formats, integration with external IdPs, or IP address-based controls. Lambda authorizer results can be cached, and setting a TTL reduces duplicate authentication Lambda invocations. IAM authentication uses AWS SigV4 signatures to authenticate requests and is suited for internal communication between AWS services.

Throttling and Usage Plans

API Gateway throttling is implemented using the token bucket algorithm. The default account-level limit is 10,000 requests per second per Region, with a burst of 5,000 requests. Finer-grained limits can be set at the stage and method levels to prevent specific endpoints from overloading the backend. Usage plans are a REST API-specific feature that lets you set daily and monthly request limits and throttling rates per API key. When exposing APIs to external partners, you can apply different rate limits per partner. Clients that receive a 429 Too Many Requests response should implement retries with exponential backoff.

API Gateway Pricing

HTTP API costs approximately $1.00 per million requests, roughly 71% cheaper than REST API at $3.50 (as of August 2026). WebSocket API costs approximately $1.00 per million messages plus connection time charges (approximately $0.25 per million minutes). Enabling REST API caching incurs hourly charges based on cache memory size ($0.02/hour for 0.5 GB). Properly setting Lambda authorizer cache TTL to reduce the number of authentication Lambda invocations is also effective for cost optimization. Under the legacy 12-month free tier (accounts created before July 15, 2025), 1 million requests per month each for HTTP API and REST API were included. Accounts created after that date use the credit-based free plan (up to $200 in credits); see the official AWS site for current terms.

Summary

API Gateway is a service that centrally manages authentication, throttling, and monitoring at the API layer as the entry point for serverless architectures. By defaulting to HTTP API and choosing REST API only when enterprise features are needed, you can optimize both cost and latency.

References (Official AWS Resources)

The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.

If this page and the official documentation disagree, treat the official documentation as authoritative.

Related Services

Amazon API Gateway PopularA fully managed service for creating, publishing, managing, and monitoring APIsAWS Lambda EssentialA serverless compute service that runs code without server managementAmazon Cognito PopularA service that provides authentication, authorization, and user management for web and mobile applications

Related Articles

Designing Workflow Orchestration with AWS Step Functions - Choosing Between Standard and ExpressClarify the selection criteria between Standard and Express workflows, and learn about declarative error handling with Retry/Catch and large-scale parallel processing with distributed maps.Building Real-Time GraphQL APIs with AWS AppSync - Subscriptions and Resolver DesignImplement real-time notifications with WebSocket-based subscriptions and integrate multiple data sources using DynamoDB and Lambda pipeline resolvers.Implementing User Authentication with Amazon Cognito - Designing User Pools and Identity PoolsLearn about user authentication with Cognito User Pools, AWS resource access with Identity Pools, and social login integration.

More on This Topic

Amazon EFS Integration with Lambda and ECS - Shared File Systems in Serverless ArchitecturesMount EFS on Lambda functions and ECS tasks to leverage shared file systems. Learn access point design and performance optimization techniques.Why Lambda's Limit Is 15 Minutes - The Rationale Behind Serverless Design ConstraintsThis article explains why Lambda's various limits - 15-minute maximum execution time, 10GB memory cap, 6MB payload - are set at those specific values, from the perspective of Firecracker's design philosophy and multi-tenant operations.Understanding Lambda Cold Starts and Choosing Among Three Optimization StrategiesThis article explains the mechanism behind Lambda cold starts from the Firecracker MicroVM lifecycle perspective, and compares optimization techniques across three axes: SnapStart, Provisioned Concurrency, and function design in terms of cost and constraints.Getting Started with Serverless Development Using AWS Lambda - Function Design and Event Source IntegrationThis article covers Lambda function design, event source mapping, cold start mitigation, and Powertools usage.Behind Lambda's 1,000 Concurrent Executions - How Firecracker Warm Pools and Worker Managers WorkThis article explains how Lambda manages MicroVMs within the default concurrency limit of 1,000, the warm pool reuse strategy, worker manager placement decisions, and internal optimizations that reduce cold start rates.Building Serverless APIs - Scalable API Infrastructure with Amazon API GatewayLearn how to build serverless APIs using Amazon API Gateway and Lambda.Designing State Machines - Workflow Orchestration with Step FunctionsLearn state machine design techniques with AWS Step Functions, including visual workflows, error handling, and workflow orchestration through Lambda integration.Designing Workflow Orchestration with AWS Step Functions - Choosing Between Standard and ExpressClarify the selection criteria between Standard and Express workflows, and learn about declarative error handling with Retry/Catch and large-scale parallel processing with distributed maps.

Similar Articles and Services

Building Serverless APIs - Scalable API Infrastructure with Amazon API GatewayLearn how to build serverless APIs using Amazon API Gateway and Lambda.Amazon API GatewayA fully managed service for creating, publishing, and managing REST APIs, HTTP APIs, and WebSocket APIs, serving as the front door to Lambda and other AWS servicesImplementing User Authentication - Building a Secure Authentication Foundation with CognitoLearn how to design and implement a user authentication foundation using Amazon Cognito, including building authentication flows with user pools, identity pools, and external identity provider federation.How AWS API Throttling Works - The Token Bucket Algorithm and the Truth Behind 429 ErrorsLearn how AWS API rate limiting is implemented using the token bucket algorithm, understand the concept of burst capacity, explore differences in throttling limits across services, and discover practical strategies to avoid throttling.