Open it to a caller: a key and a limit

APIM 2 · 3:28

A named caller gets an API key and a rate limit in place of anonymous access, and the gateway turns away calls over the limit. The video also rotates a leaked key and disables and enables a caller.

Download the mp4Recorded on 2026.2

What it covers

Deleting the anonymous subscription, which closes the API to callers without a key
An API key subscription for partner-x with a limit of 60 calls a minute
Calling with the key in the X-Api-Key header
Sending 61 calls in a burst, and the 429 that the gateway returns for the call over the limit
Rotating a leaked key with weikio subscription rotate-key, and disabling and enabling a caller
The Subscriptions section on the API's page in the admin UI

Commands in this video

Terminal

$ weikio delete subscription finance/first-look --env production
$ weikio subscription create finance/partner-x --env production --api invoices --type apikey --rate-limit 60/60s
$ curl http://api.example.com/invoices/1.0/orders/42 -H "X-Api-Key: $API_KEY"
$ for i in $(seq 1 61)
do
  curl -s -o /dev/null -w '%{http_code}\n' http://api.example.com/invoices/1.0/orders/42 -H "X-Api-Key: $API_KEY"
done
$ weikio subscription rotate-key finance/partner-x --env production
$ weikio subscription disable finance/partner-x --env production
$ weikio subscription enable finance/partner-x --env production

Transcript

0:02A published API isn't handed to any caller yet.
0:05This video hands the API to a named caller, with a key and a limit on calls.
0:14The gateway serves API invoices in production,
0:18forwarding to the orders-api integration.
0:22The door stands open to anyone.
0:25The anonymous subscription keeps it open and asks nothing of a caller.
0:33Delete first-look in production with weikio delete subscription finance/first-look.
0:40The Weik.io CLI asks first, because this writes into production.
0:46Now nobody gets in without a credential.
0:51A subscription is a short document saying who can call.
0:55It pins a caller, project and environment, so keys don't cross environments.
1:00The type sets how the caller proves itself, here API key.
1:06The limit allows 60 calls a minute.
1:13weikio subscription create finance/partner-x opens API invoices with an API key and 60 calls a minute.
1:23The key prints once, and only a hash is kept.
1:27The output names the command that replaces the key.
1:32partner-x calls the production host name, sending its key in the header.
1:37The gateway matches the key to partner-x's subscription and lets the call through.
1:42The API answers as always.
1:47The same call is now made past the ceiling.
1:50Only the status of each answer is printed.
1:53The gateway's count of this subscription's calls refused that one before the API behind saw it.
1:59The answer is the status for too many requests.
2:02The ceiling belongs to this environment too.
2:09When a key leaks, weikio subscription rotate-key finance/partner-x replaces it.
2:16The old key stops at the next route table, and the new one prints once.
2:20partner-x calls again with the new key.
2:25weikio subscription disable switches the caller off and deletes nothing.
2:32The same key lets the caller back in.
2:40The API's own page in the admin UI keeps the same facts.
2:45The Subscriptions section lists partner-x under production.
2:49The row gives the API key as the way this caller proves itself.
2:53The row carries the 60-calls-a-minute ceiling the burst ran into.
3:02The door that was open to everyone is closed.
3:05partner-x gets in with a key that belongs to it.
3:08The gateway counts every call against the ceiling and answers the calls that pass it.
3:13The caller is switched off and back on without anything being deleted.

Next in this track

APIM 3 · 3:33 Watch the calls