<p>Besides setting <code>API Key Required = false</code>, I was missing something in <code>API Gateway</code> <code>&gt;</code> <code>Custom domain names</code>:</p>
<p>The API Mapping had no stage selected. When I selected <code>dev</code>, the endpoint worked.</p>
<p><a href="https://i.sstatic.net/VVOS3.png" rel="noreferrer"><img src="https://i.sstatic.net/VVOS3.png" alt="Api Gateway Mappings" /></a></p>

CC BY-SA 4.0
2022-06-24T22:51:50.630Z
2022-06-24T22:51:50.630Z
soniaseguz
<blockquote>
<p>When you deploy an edge-optimized API, API Gateway sets up an Amazon CloudFront distribution and a DNS record to map the API domain name to the CloudFront distribution domain name. Requests for the API are then routed to API Gateway through the mapped CloudFront distribution.</p>
</blockquote>
<p>Source: API Gateway documentation — <a href="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-custom-domains.html#edge-optimized-custom-domain-names" rel="nofollow noreferrer">Edge-optimized custom domain names</a>.</p>
<hr />
<p>To allow calls to a method of a resource in your API without API key, set its <code>API Key Required</code> setting to <code>false</code>:</p>
<p><a href="https://i.sstatic.net/NNkLS.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/NNkLS.png" alt="enter image description here" /></a></p>

CC BY-SA 4.0
2020-07-18T14:32:06.953Z
thank you @Harish KM! I've changed the API type to regional, but still the API remains closed. At least half of my question is now answered. :-)
Ta Mu
CC BY-SA 4.0
2020-07-19T06:53:27.283Z
@PeterMuryshkin I've updated the answer to show how to make the API accept a call without an API key.
Harish KM
CC BY-SA 4.0
2020-07-19T09:36:06.477Z
thank you, Harish! Your hint has helped me in the right direction though I couldn't find the setting edit option in the UI, possibly with ANY selector it's different mode.
Ta Mu
CC BY-SA 4.0
2020-07-19T11:04:33.197Z
@PeterMuryshkin Click `Method Request` to get to the settings, as shown [here](https://i.imgur.com/lOxYoGj.png).
Harish KM
CC BY-SA 4.0
2020-07-19T13:01:08.373Z
I see now! thx.
Ta Mu
CC BY-SA 4.0
2021-06-16T22:33:35.900Z
I am still having this issue after I changed the `API Key Required` property to `false`.  Any ideas?
Jeremy Hamm
CC BY-SA 4.0
2021-06-17T04:02:46.760Z
@JeremyHamm Remember to save the change by clicking the tiny tick mark next to `API Key Required` after you change it from `true` to `false`. Also remember to deploy the API to a stage before testing it: `Actions` menu > `Deploy API`.
Harish KM
CC BY-SA 4.0
2020-07-18T14:31:01.113Z
2020-07-19T06:50:21.157Z
2020-07-19T06:50:21.157Z
Harish KM
<p>How can happen that with a Lambda/API Gateway combination, if no explicit Cloud Front configuration has been done, in an error response header they mention CloudFront?</p>
<pre><code>header: x-amzn-ErrorType: ForbiddenException
header: x-amz-apigw-id: P3mmbT_DREF8bg=
header: X-Cache: Error from cloudfront
</code></pre>
<p>Actual problem: with a disabled API key, API keeps responding &quot;forbidden&quot;.</p>
<p>UPDATE. As it seems the problem is not related to the Edge API/CloudFront, as the problem with disabled key persists also on changing API type to regional.</p>
<p>UPDATE. I can now disable API key checking as suggested by @Harish i.e. it's not about disabling the API key itself but telling the API whether it's required or not.</p>
<p>What is yet open though is why if created by <a href="https://github.com/Miserlou/Zappa" rel="nofollow noreferrer">Zappa</a>, there is no option to change this setting in the UI, because there are not single methods.</p>
<p><a href="https://i.sstatic.net/8tFRY.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/8tFRY.png" alt="zappa-methods" /></a></p>

CC BY-SA 4.0
2020-07-18T15:59:23.590Z
What response do you expect from the API when you call it with a disabled API key?
Harish KM
CC BY-SA 4.0
2020-07-18T16:25:02.790Z
the client sends no key, the API has it disabled. So my expectation is that API accepts the call normally.
Ta Mu
CC BY-SA 4.0
2020-07-19T14:51:42.843Z
Use [Zappa's `api_key_required` setting](https://github.com/Miserlou/Zappa#api-key) to enable/disable API key requirement for individual routes in your API.
Harish KM
<amazon-web-services><amazon-cloudfront>
AWS API Gateway: 403 forbidden with disabled API key; error from cloudfront
Ta Mu
# AWS API Gateway: 403 forbidden with disabled API key; error from cloudfront

(Asked by: username_0 on 2020-07-18)

How can happen that with a Lambda/API Gateway combination, if no explicit Cloud Front configuration has been done, in an error response header they mention CloudFront?
header: x-amzn-ErrorType: ForbiddenException
header: x-amz-apigw-id: P3mmbT_DREF8bg=
header: X-Cache: Error from cloudfront

Actual problem: with a disabled API key, API keeps responding "forbidden".
UPDATE. As it seems the problem is not related to the Edge API/CloudFront, as the problem with disabled key persists also on changing API type to regional.
UPDATE. I can now disable API key checking as suggested by @Harish i.e. it's not about disabling the API key itself but telling the API whether it's required or not.
What is yet open though is why if created by Zappa, there is no option to change this setting in the UI, because there are not single methods.

**Tags:** amazon-web-services, amazon-cloudfront

> **Comments:**
> **username_1**: What response do you expect from the API when you call it with a disabled API key?  
> **username_0**: the client sends no key, the API has it disabled. So my expectation is that API accepts the call normally.  
> **username_1**: Use [Zappa's `api_key_required` setting](https://github.com/Miserlou/Zappa#api-key) to enable/disable API key requirement for individual routes in your API.  

---

## 2 answers

### Answer by username_1 on 2020-07-18. Score: 3 | Accepted answer

> When you deploy an edge-optimized API, API Gateway sets up an Amazon CloudFront distribution and a DNS record to map the API domain name to the CloudFront distribution domain name. Requests for the API are then routed to API Gateway through the mapped CloudFront distribution.

Source: API Gateway documentation — [Edge-optimized custom domain names](https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-custom-domains.html#edge-optimized-custom-domain-names).

---

To allow calls to a method of a resource in your API without API key, set its `API Key Required` setting to `false`:

[![enter image description here](https://i.sstatic.net/NNkLS.png)](https://i.sstatic.net/NNkLS.png)

> **Comments:**
> **username_0**: thank you @username_1! I've changed the API type to regional, but still the API remains closed. At least half of my question is now answered. :-)  
> **username_1**: @PeterMuryshkin I've updated the answer to show how to make the API accept a call without an API key.  
> **username_0**: thank you, Harish! Your hint has helped me in the right direction though I couldn't find the setting edit option in the UI, possibly with ANY selector it's different mode.  
> **username_1**: @PeterMuryshkin Click `Method Request` to get to the settings, as shown [here](https://i.imgur.com/lOxYoGj.png).  
> **username_0**: I see now! thx.  
> **username_3**: I am still having this issue after I changed the `API Key Required` property to `false`.  Any ideas?  
> **username_1**: @JeremyHamm Remember to save the change by clicking the tiny tick mark next to `API Key Required` after you change it from `true` to `false`. Also remember to deploy the API to a stage before testing it: `Actions` menu > `Deploy API`.  

---

### Answer by username_2 on 2022-06-24. Score: 5

Besides setting `API Key Required = false`, I was missing something in `API Gateway` `>` `Custom domain names`:

The API Mapping had no stage selected. When I selected `dev`, the endpoint worked.

[![Api Gateway Mappings](https://i.sstatic.net/VVOS3.png)](https://i.sstatic.net/VVOS3.png)


---

