Skip to content
Get packs

Guide · Agent skill

How to use the API Gateway Security and Rate Limiting skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This is an agent skill, a packaged set of instructions that an AI coding agent loads when your request matches its topic. The API Gateway Security and Rate Limiting skill (skill name api-gateway-backend-security-and-rate-limiting, licensed Apache-2.0) gives the agent step-by-step guidance for protecting an API served through Google Cloud API Gateway. It is aimed at backend developers and platform or DevOps engineers. After this guide you will know how to install the skill, ask for the right tasks in plain language, and what safety checks to keep in place before anything touches a live gateway.

API Gateway Security and Rate Limitinggoogle/skills · Apache-2.0

Quick start

  1. 1Download and unzip the skill. Download the ZIP from this page and unzip it. Place the folder in ~/.claude/skills/ for personal use or in your project's .claude/skills/ folder.
  2. 2Install the tools and set credentials. Install the Google Cloud SDK and PyYAML, then run gcloud auth login or gcloud auth application-default login.
  3. 3Select the project and enable APIs. Set your project with gcloud config set project, confirm billing is linked, and enable API Gateway, Service Management, Service Control, IAM and API Keys.
  4. 4Ask for the security goal. Describe what you want in plain language, such as adding API key and JWT auth or locking down a Cloud Run backend, and mention API Gateway.
  5. 5Review and approve changes. Read each gcloud command and IAM change the agent proposes, then approve it only after you have checked the order of operations.

What the skill makes the agent do

Once installed, the agent knows how to set up client authentication with API keys and JWT, restrict direct access to a Cloud Run or Cloud Functions backend with a dedicated gateway service account, read verified user claims from the gateway header, and apply per-project request quotas.

It also helps diagnose HTTP 429 and HTTP 500 quota errors, and includes a script that checks a new API config does not break quota metrics used by older gateways. The skill covers OpenAPI 2.0 and OpenAPI 3.0.x configurations, including gateways with MCP enabled (Public Preview).

  • Client authentication: API keys and JWT
  • Backend lockdown: gateway service account plus restricted invoker access
  • User claims: decode the X-Apigateway-Api-Userinfo header
  • Rate limits: per-project quotas
  • Quota check: scripts/check_quota_metrics.py before creating a new API config

How do you install the skill?

Download the ZIP file from this page and unzip it. For a personal setup, place the skill folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.

You can also upload the skill in the Claude apps under Settings → Capabilities → Skills.

  • Personal: ~/.claude/skills/
  • Per project: .claude/skills/ inside your project folder
  • Claude apps: Settings → Capabilities → Skills, then upload

What you need before the agent can work

The skill runs gcloud commands and network calls, so set up the tools first. You need the Google Cloud SDK (gcloud CLI), and Python 3.10 or newer with PyYAML version 6.0 or later but below 7.0 for the quota check script. You also need a Google Cloud project with billing enabled and the API Gateway, Service Management, Service Control, IAM and API Keys APIs enabled.

Authenticate with gcloud auth login for a local session, or gcloud auth application-default login for SDKs. Your account needs IAM roles such as roles/apigateway.admin, roles/iam.serviceAccountAdmin and roles/run.invoker.

  • Google Cloud SDK (gcloud CLI)
  • Python 3.10+ with PyYAML >=6.0,<7.0
  • Billing enabled on the project
  • Enabled APIs: API Gateway, Service Management, Service Control, IAM, API Keys
  • Credentials via gcloud auth login or application default credentials
pip install "PyYAML>=6.0,<7.0"

How do you trigger the skill with natural requests?

You do not need special syntax. Describe the security or quota goal in plain language and mention API Gateway, and the agent should load the skill. Good requests name the goal, the backend and the gateway, for example asking it to lock a Cloud Run backend so only the gateway can call it.

Expect the agent to ask for human approval before steps that change IAM roles, grant invoker permissions, or create an API config that changes quotas. That is intentional.

  • Lock down the Cloud Run backend for my API Gateway so only the gateway can call it.
  • Add API key and JWT authentication to my OpenAPI 3.0 gateway config.
  • Read the verified user email from X-Apigateway-Api-Userinfo in my handler.
  • Set a per-project limit of 100 requests a minute on my API.
  • I am getting HTTP 429 and HTTP 500 quota errors from API Gateway. Help me diagnose them.

What safety rules should you follow?

Read the safety notes before you run anything. The skill is not for Apigee, GKE Gateway API, or Cloud Load Balancing custom domain setup, and its guidance would be wrong for those products. Do not apply production changes without review, because a wrong order can cause 403 downtime or HTTP 500 errors.

Do not treat API keys as user login. The skill warns that keys identify a Google Cloud project and can be extracted from clients. The skill also tags gcloud commands with an attribution variable set inline on each command, rather than with gcloud config set.

  • Review every gcloud command and IAM change before it runs on live backends.
  • Create the gateway service account first; never use the Compute Engine default service account.
  • Roll out the gateway config with --backend-auth-service-account before setting --no-allow-unauthenticated.
  • Use API keys for quotas and billing, and JWT for end-user identity.
  • The skill runs scripts and uses the network, so check them the way you would any script.

Tips for getting reliable results

Give the agent your project ID, gateway location and API ID up front. The skill defaults to us-central1 for the --location flag, so say so if you use another region. Run the quota check against your active gateways before any api-configs create, since creating a config replaces quota definitions across all gateways of the API.

If you work offline or in CI, the quota script can be run with the specification you provide. Keep the candidate OpenAPI file in version control so you can review diffs.

  • State the OpenAPI version (2.0 or 3.0.x) of your spec.
  • Name the backend type: Cloud Run, or Cloud Functions (1st or 2nd gen).
  • Ask for a review step before any live change.
  • Never rename or remove a quota metric while an older gateway still references it.
python3 scripts/check_quota_metrics.py --spec={candidate_openapi_spec} --project={project_id} --api={api_id}

What people use it for

  • Locking a Cloud Run backend so only the API Gateway service account can invoke it.
  • Adding API key identification and JWT user authentication to an OpenAPI 3.0 gateway config.
  • Reading verified user claims from X-Apigateway-Api-Userinfo in a backend handler.
  • Checking a new API config for quota metric conflicts before deploying it to a live API.

Frequently asked questions

Is the API Gateway Security and Rate Limiting skill free?

The skill is licensed under Apache-2.0, as listed on this page. Google Cloud API Gateway itself requires a billing account linked to your project, even when you stay within the API Gateway pricing free tier.

What do I need before I install this skill?

You need the Google Cloud SDK (gcloud CLI), Python 3.10 or newer with PyYAML from 6.0 up to but not including 7.0, a Google Cloud project with billing enabled, and the required APIs and IAM roles enabled.

Where do I put the skill folder after downloading?

Unzip it into ~/.claude/skills/ for personal use, or into .claude/skills/ inside a project. You can also upload it in the Claude apps under Settings → Capabilities → Skills.

Can I use API keys alone to authenticate users?

No. The skill says API keys identify a Google Cloud project rather than a user, and clients can extract them. For end-user identity, use JWT authentication alongside the API key where the endpoint needs quotas.

Why am I getting HTTP 429 or HTTP 500 quota errors?

The skill helps diagnose these errors. HTTP 500 Failed to call Service Control Quota can happen when a new API config renames or removes a quota metric that older gateways still use, so check metrics with the quota script before creating a config.

How is this different from Apigee or a Cloud Load Balancing setup?

This skill covers only Google Cloud API Gateway. It explicitly excludes Apigee, GKE Gateway API, and Cloud Load Balancing custom domain setup, so use a different skill or guide for those products.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use this skill if you deploy APIs behind Google Cloud API Gateway and need authentication, backend lockdown or per-project rate limits, and you are comfortable reviewing gcloud commands before they run. Pick something else if you use Apigee, GKE Gateway API or Cloud Load Balancing custom domains, or if you expect API keys alone to identify end users.

Download the skill