Managing implementation · Topic 2 of 3
API Management with Apigee
API management with Apigee: proxies, API products, quotas, developer portals, analytics and security, and when API Gateway or Endpoints fits.
- 4 min
- Includes a diagram
- Proxies, policies, API products, developer apps, portal, analytics.
- Quotas and spike arrest protect back ends; caching reduces load.
- Apigee hides back ends, so they can move without breaking consumers.
What it is
API management puts a managed layer between API consumers and back-end services. It controls who can call which API, how often, and how securely, and it shows how APIs are used. Apigee is Google Cloud's full API management platform; API Gateway and Cloud Endpoints are lighter options.
How it works
Apigee building blocks
| Concept | What it does |
|---|---|
| API proxy | The managed front for a back-end service; applies policies to each request |
| Policies | Authentication (API keys, OAuth 2.0, JWT), quotas, spike arrest, transformation, caching |
| API products | Bundles of APIs with their quota and access terms, offered to consumers |
| Developer apps and keys | What each consumer registers to get credentials for products |
| Developer portal | Self-service site where partners discover APIs, register and get keys |
| Analytics | Traffic, latency, errors and usage per API, product and developer |
| Monetization | Charging consumers for API use |
Best practices
- Design APIs as products: stable, versioned, documented contracts (OpenAPI), not raw back-end endpoints.
- Tier access: different API products for different quota levels or partner types.
- Protect back ends: quotas and spike arrest absorb bursts; caching reduces load.
- Secure every call: OAuth or keys, threat protection policies, TLS, and Cloud Armor at the edge where needed.
- Hide the back end: consumers see the proxy, so services can move (for example from on premises to Cloud Run) without breaking partners.
- Version carefully: run old and new versions side by side and retire old ones with notice.
- Measure: use analytics to see who uses what and to plan capacity.
When partners must self-register, get keys without tickets and have per-partner analytics, the answer is Apigee with a developer portal and API products.
Apigee in hybrid architectures
Apigee proxies can front back ends anywhere: Google Cloud services, other clouds, or on-premises systems reached over Interconnect or VPN. This makes Apigee a common way to expose a legacy system (an ERP or mainframe function) as modern APIs with no change to the legacy system itself. Apigee hybrid runs the runtime plane in your own Kubernetes clusters when traffic must stay on premises.
Choosing an API layer
| Need | Choice |
|---|---|
| Full lifecycle: products, portal, monetization, rich analytics, partner programs | Apigee |
| Simple managed gateway for serverless back ends with keys and basic quotas | API Gateway |
| API management for services you run, using a proxy (ESPv2) beside them | Cloud Endpoints |
Accessing Google APIs well
Google's own APIs follow the same principles from the consumer side:
- authenticate with service accounts or federated identities, never user passwords in code;
- handle quota errors with exponential backoff and retries;
- use batch or bulk APIs where available;
- request only the scopes and roles needed.
A worked scenario
A retailer will open catalog and order APIs to dozens of marketplaces. Each partner needs its own quota tier, must register and get keys through a branded portal, and the retailer wants usage per partner. Apigee with an API product per tier, a developer portal and Apigee analytics meets all three; a load balancer with Cloud Armor or API Gateway with platform-issued keys lacks the self-service portal and partner analytics.
How the exam asks about this
- "Dealer portal must reach the ERP only through a managed layer, with no change to the ERP." Apigee proxies over the hybrid link.
- "Insurance providers onboard faster." Apigee API products and a portal.
- "Simple gateway for a few Cloud Run functions." API Gateway.
What to remember for the exam
- Proxies, policies, API products, developer apps, portal, analytics.
- Quotas and spike arrest protect back ends; caching reduces load.
- Apigee hides back ends, so they can move without breaking consumers.
- Apigee for full lifecycle and partner programs; API Gateway for simple serverless needs.
- Call Google APIs with proper identities and exponential backoff.
Rate limiting at the load balancer alone gives no per-partner products, keys or analytics.
Common mistakes
Exposing back-end services directly to partners.
One quota for all partners when contracts differ.
Breaking changes without versioning.
Check yourself
Which Apigee feature bundles APIs with quota and access terms?
API products.
How do partners get keys without support tickets?
Through an Apigee developer portal where they register apps.
How should clients handle quota errors from Google APIs?
Retry with exponential backoff.
Topic 2 of 3 in Managing implementation
Test yourself on Managing implementation
The full Google Cloud Professional Cloud Architect question bank has 877 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.