Help Center/ API Gateway/ User Guide/ Process of Using APIG
Updated on 2026-05-19 GMT+08:00
View PDF
Share

Process of Using APIG

APIG is a fully managed service that enables you to securely build, manage, and deploy APIs at any scale with high performance and availability. With APIG, you can easily integrate your internal service systems and selectively expose and monetize your service capabilities.

APIG provides dedicated gateways and shared gateway (for existing users). The shared gateway has been brought offline and can be used only by existing users. For details about how to use the shared gateway, see Shared Gateway (for Existing Users).

General Procedure

The following figure shows the procedure for using APIG to host APIs.

Figure 1 Process of using APIG
  1. Using IAM to Grant Access to APIG

    Create a user and grant APIG permissions with IAM. If the preset permissions do not meet requirements, you can create custom policies.

  2. Creating a Gateway

    A gateway is an independent resource space where all operations are performed. Resources of different gateways are isolated from each other. To open APIs for external services, you need to create a gateway first.

    After a gateway is created, you can configure its parameters, classify resources by group (Configuring Gateway Tags), and connect the VPC endpoint to the VPC endpoint service (Configuring Gateway VPC Endpoints). For more operations, see Managing APIG Gateways.

  3. Opening APIs

    Open services and data by directly providing open APIs to API callers or releasing them on KooGallery for monetization.

    To use your own authentication system for API calling, perform operations in Configuring Custom API Authentication. To orchestrate API parameters, perform operations in Configuring API Parameter Orchestration Rules. To customize API error responses, perform operations in Customizing Error Response for APIs. For more operations, see Managing APIs.

  4. (Optional) Configuring Authorization for API Calling

    Credentials need to be authorized to call APIs that use App authentication. API callers use the key and secret to authenticate API requests. They can also use the AppCode for simple authentication.

    If you want to limit the number of API calls made by an API caller in a specified period, you can perform operations in Credential Quota Policy. If you want to control the IP addresses that can access an API, you can perform operations in Credential Access Control Policy.

  5. Calling APIs

    Obtain the API and its access address to call the API. Authentication operations need to be performed depending on the authentication mode.