SPEAKER: Hello, and welcome to this episode of the "Apigee
Accelerator Series."
In this video, we'll be demonstrating
how to implement a basic API consumption limit using
Apigee's built-in quota policy.
Apigee's quota policy allows you to easily set API consumption
limits for client applications.
Imagine you'd like to set up a quota
to limit the number of calls to your API over a given interval.
For example, per minute, per hour, or per day.
You may want to only allow a set number of API calls
during that time period and disallow
anything over the limit.
You can implement this using Apigee's quota policy.
Apigee allows you to set the quota
to be the same for all consumers,
or you can set dynamic quotas based
on the API product containing a proxy, the specific app that
makes the request, the app developer,
or many other criteria.
Here, we'll show how to enforce a dynamic quota defined
by the API product.
We'll create two products with different quotas
to demonstrate how different consumption tiers can
be configured for the same API.
Let's begin.
In order to run this sample, you'll
need the following-- an Apigee X instance provisioned
with access configured for external traffic.
As a user, you'll need permissions
to deploy API proxies, create API products,
and register developers and applications.
This can be granted to the Apigee Org Admin
role or the API and developer admin roles.
To deploy this sample, you'll also
need the command line tools shown here.
If you're using Google Cloud Shell,
these are already installed.
We've included a Google Cloud Shell
tutorial, which you can simply click to quickly get started.
Now that you're in the Cloud Shell environment,
you can follow along with the step-by-step instructions.
First, make sure you're logged in with the right account.
Then change to the directory for this sample.
To deploy the sample, first open up the env.sh file
and set the configuration to reference your Apigee project
environment and the external hostname.
Next, run the included script to deploy the sample
to your Apigee instance.
This might take a minute to complete.
When the script completes, you should
see a message showing the API proxy URL and two API keys.
The two API keys represent two applications
subscribed to the two different API products, which
each have different quotas.
You'll use these keys to test the quota behavior.
Now run the curl command with the first API key
several times.
Notice how the values in the output
update to reflect the quota counter on each request.
On the 11th call, the response returns an HTTP 429 status
code, which indicates the quota has been exceeded.
The proxy also returns a customized response body
containing more detail about the error.
Next, try the requests using the second API key.
This time, notice the newer, larger value
in the allowed field in the response payload.
This value reflects the larger quota allowed by the second API
product.
Now you've seen the policy in action,
let's look at how this is configured in Apigee.
In a new tab, open the Apigee Management UI,
@apigee.google.com.
Under the API proxy section, you should see the basic quota
proxy.
Select the proxy and go to the Develop tab.
You'll see several policies defined.
First, the verify API key policy checks
for the presence of a valid API key that corresponds
to a registered application.
The quota policy is configured to check against a quota limit
and interval defined in the API product used by the caller.
The applicable API product information
is supplied by the verifyapikey policy
in a set of flow variables.
Under the API product section, you'll
see two different API product definitions.
The first is a trial product, which
has a quota set to 10 requests per minute.
The first application you tested is subscribed to this product,
and you can see that app listed at the bottom.
The second product is a premium version
of the API, which allows 1,000 requests per hour.
The second application you tested
is subscribed to this product.
And therefore, it's allowed to make more requests.
This simple example shows how you can easily
allow different levels of consumption
for different sets of API subscribers.
When you're done with the sample,
you can provide us with your feedback,
and then you can use the clean up script
to delete the configuration that was deployed to your Apigee
org.
We hope you found this sample useful.
And if you enjoyed the video, please
hit the Like button below.
You can also subscribe to our channel
to see more videos in the "Apigee Accelerator Series."
If you have questions, please post them
on the Apigee community.
Thanks for watching.