Assuming your API is publicly accessible (for Saas) or reachable from your 3scale AMP installation (for on-premises), you can prototype the 3scale access control layer within a few minutes.

The Echo API will serve as en example of a public API. It is a simple API that accepts any path and returns information about the request (path, request parameters, headers, etc.) in the response body. It is accessible at the following URL: https://echo-api.3scale.net

In the preceding steps, you ensured that only authenticated calls are allowed through to your API. In this section you will apply policies to differentiate the rate limits.

In 3scale, applications define the credentials to access your API. An application is always associated with one application plan that determines the access policies. Applications are stored within developer accounts. In the basic 3scale plans only a single application is allowed; but, in the higher plans, multiple applications per account are allowed.

In this example, you add a policy to the Echo API used in the preceding section.

You have now successfully defined more restrictive access polices for all the applications on the basic plan.

For the prototype, you do not need to create any documentation content. It is usually enough to check that the workflows will meet your requirements. For example, while the API is in development and testing, you may want to disable the full self-service workflow:

You can now successfully customize workflows for your developer portal.

For a full production implementation, you need to make some fundamental decisions about how to structure your API and implement integration with 3scale.

You have the choice of several authentication modes for API traffic. Consult the guide on the available options and configure the settings.

You also have several deployment options for the API traffic manager layer. APIcast, the NGINX based API gateway, is the favorite amongst 3scale customers due to its combination of ease of configuration and performance. You can use hosted APIcast which is great to get started quickly, but comes with volume limits and additional latency. Alternatively, you can deploy it on your own servers for the best performance and completely unrestricted traffic volume.

Hosted APIcast

Self-managed APIcast

The Developer Portal Guide contains information to create and use a Developer Portal. Consider writing your content in Textile or Markdown. Following are optional steps that you may want to consider:

Advanced authentication mode: OpenID Connect

Secure your APIs using the APIcast integration with OpenID Connect for Red Hat Single Sign-On (RH-SSO). Applications in the Red Hat 3scale API Management Platform are synchronized with the Identity Provider (IdP), in this case RH-SSO. Currently, this is an end-to-end supported solution. It covers the main OAuth 2.0 flows: Authorization code, Resource password owner, Client credentials, and Implicit grant.

Code plugin deployment

Almost all 3scale customers find performance to be fine. But, if you want to turbo-charge your API, you can cache authorization calls to 3scale using any caching library that you are comfortable with.

In the preceding section, you ensured that only authenticated calls are allowed through to your API. In this section, you apply policies to differentiate rate limits.

In 3scale, applications define the credentials to access your API. An application is always associated with one application plan that determines the access policies. Applications are stored within developer accounts. In the basic 3scale plans, only a single application is allowed. In the higher plans, multiple applications per account are allowed.

Alerts may be configured to send notifications by email or to the web consoles: . Go to your API Settings page: [Your_API_name] > Integration > Settings. . Go to the Alerts section on the page. Here, you can configure the alerts that you want as a percentage of your rate limit levels.

3scale gives you the flexibility to decide whether to make rate limits soft (even calls above the limits are allowed through) or hard (calls are rejected before hitting your application). With the code plugin, you consciously need to decide which type to implement. On the other hand, APIcast defines hard limits by default. These can be customized in the Lua file to avoid rejecting over-limit calls.

After you have completed the basic path, following are the two advanced areas to explore for the developer portal:

Here you can add as many methods and metrics as you need. By default, they will be available in all plans of your service.

For more details about how to add methods and metrics, you can check out our documentation page about defining your API on 3scale.

For this simple test, add just two methods under hits with system names:

In addition to creating the metrics/methods, you can also add limits to any of the API usage metrics under each plan. Create a new application plan for this example. Navigate to [your_API_name] > Overview > Create Application Plan.

In the form that opens, specify the desired name – for example HelloEchoTest – and the system name. Then click on Create Application Plan button.

After the previous step, you should see the list of application plans. Click on the HelloEchoTest plan to create limits for the metrics and methods. You should be able to see all the metrics and methods that you defined in the previous step. Click on the Limits icon under any metric or method. Adding a limit to the Hits metric applies the rule across all the methods under Hits; adding limits to a method only applies to that method. You can create different plans with different limits later on.

Limits restrict the number of API calls an application on this plan can do per minute/hour/day/etc.

Go to Audience > Accounts > Listing and click on the Create button.

Fill in some information for the new developer who will access the API.

Once you click Create, select the new account from the list to go to the home page.

The account area lists all the companies and developers signed up to use the API. New companies can be added from the Admin Portal, from the API, or by self-service signup on the developer portal.

When you create a new developer account, you will also be creating a new application for that account.

Applications will each have a unique key to access the API. To find that key, click on the application name and check the API credentials section.

These are the keys the Curious Echo app will use to call the Echo API. Lastly, on the right-hand side of the application details page (see screenshot above), select the Change Plan dropdown and select the plan you created and named earlier, Echo Test, and confirm the change. This applies the new plan to this application.

You have now configured the management system for your first application.