Chapter 3. APIcast hosted

Once you complete this tutorial, you will have your API fully protected by a secure gateway in the cloud.

APIcast hosted is the best deployment option if you want to launch your API as fast as possible, or if you want to make the minimum infrastructure changes on your side.


3.1. Deploying your API with APIcast hosted in a staging environment

The first step is to configure your API and test it in your staging environment:


  1. Define the private base URL and its endpoints.
  2. Choose the placement of credentials and other configuration details. For more information see the APIcast Hosted documentation.
  3. After entering your configuration, click Update & test Staging Environment to run a test call. This will go through the APIcast staging instance to your API.

You will see a green confirmation message when your configuration is complete.

Before moving on to the next step, make sure that you have configured a secret token to that you backend service validates. You can define the value for the secret token under Authentication Settings. This will ensure that nobody can bypass APIcast access control.

3.2. Deploying your API with the APIcast hosted into production

At this point, you are ready to take your API configuration to a production environment. To deploy your 3scale Hosted APIcast instance:


  1. Go back to the Integration and Configuration page and click on the 'Promote to v.x to Production' button.
  2. Repeat this step to promote further changes in your staging environment to your production environment.

It will take between 5 and 7 minutes for your configuration to deploy and propagate to all the cloud APIcast instances. During redeployment, your API will not experience any downtime. API calls may return different responses depending on which instance serves the call. Deployment has been successful when the box around your production environment has turned green.

Both the staging and production APIcast instances have base URLs on the domain. You can tell them apart because the staging environment URLs have a staging subdomain. For example:

3.3. Additional information

  • 50,000 hits/day is the maximum allowed for your API through the APIcast production cloud instance. You can check your API usage in the Analytics section of your Admin Portal.
  • There is a hard throttle limit of 20 hits/second on any spike in API traffic.
  • Above the throttle limit, APIcast returns a response code of 403. This is the same as the default for an application over rate limits. If you want to differentiate the errors, please check the response body.