Skip to content
Get packs

API Gateway Security and Rate Limiting

Lock down and rate limit Google Cloud API Gateway backends with API keys, JWT, and quotas

Source Download skill
Repository
google/skills
Stars
21,782
Licence
Apache-2.0
Files
7 files

What it does

This skill gives an AI agent step-by-step guidance for protecting an API served through Google Cloud API Gateway. Once installed, the agent knows how to set up client authentication (API keys and JWT), restrict direct access to a Cloud Run or Cloud Functions backend with a dedicated gateway service account, read verified user claims from the gateway header, and apply per-project request quotas. It also helps diagnose HTTP 429 and HTTP 500 quota errors and includes a script that checks a new API config does not break quota metrics used by older gateways.

Great for

  • Backend developers deploying APIs behind Google Cloud API Gateway who need authentication and rate limits
  • Platform or DevOps engineers hardening Cloud Run or Cloud Functions backends so only the gateway can call them
  • Teams enabling MCP tool endpoints on an API Gateway (Public Preview) who need to secure them

Skip it if

  • Apigee, GKE Gateway API, or Cloud Load Balancing custom domain setup, which the skill explicitly excludes; the guidance would be wrong for those products
  • Production changes applied without review: the workflow runs gcloud commands and changes IAM roles and live backends, and a wrong order can cause 403 downtime or HTTP 500 errors
  • Anyone expecting API keys alone to identify end users, since the skill itself warns that keys identify a project and can be extracted from clients

Try asking

  • “Secure my Cloud Run backend so only my API Gateway can call it, with no public access”
  • “Add JWT authentication to my OpenAPI 3.0 spec and read the user's claims in my handler”
  • “Set a limit of 100 requests per minute per consumer project on my gateway and check the quota config is safe to deploy”
  • “Why am I getting HTTP 429 or 'Failed to call Service Control Quota' errors from my gateway?”
Step-by-step guide: how to use API Gateway Security and Rate LimitingInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    api-gateway-backend-security-and-rate-limiting.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip api-gateway-backend-security-and-rate-limiting.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip api-gateway-backend-security-and-rate-limiting.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Review every gcloud command before the agent runs it, especially IAM grants and --no-allow-unauthenticated changes, and test in a non-production project first.
  • Deploy the gateway service account configuration before restricting the backend, following the order in the skill, to avoid 403 downtime.
  • Run scripts/check_quota_metrics.py against your candidate OpenAPI file before creating a new API config, so you do not break older gateways serving the same API.

What's inside

  • references/attribution.md
  • references/backend-security.md
  • references/client-authentication.md
  • references/mcp-traffic-security.md
  • references/quotas-and-rate-limiting.md
  • scripts/check_quota_metrics.py
  • SKILL.md

Redistributed unmodified from google/skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.