How to securely hide an API key when calling a third-party HTTP API from a browser SPA?

DVA-C02 By islever Editorial Last updated

Short answer

C Use Amazon API Gateway to create a REST API. Create an HTTP integration to integrate with the third-party HTTP API. Add the company's API key to the HTTP headers list of the integration request configuration.

Question

A company is developing a publicly accessible single-page application. The application makes calls from a client web browser to backend services to provide a user interface to customers. The application depends on a third-party web service exposed as an HTTP API. The web client must provide an API key to the third-party web service by using the HTTP header as part of the HTTP request. The company's API key must not be exposed to the users of the web application. Which solution will meet these requirements MOST cost-effectively?
  1. Use Amazon API Gateway to create a private REST API. Create an HTTP integration to integrate with the third-party HTTP API. Add the company’s API key to the HTTP headers list of the integration request configuration.
  2. Use Amazon API Gateway to create a private REST API. Create an AWS Lambda proxy integration. Make calls to the third-party HTTP API from the Lambda function. Pass the company's API key as an HTTP request header.
  3. Use Amazon API Gateway to create a REST API. Create an HTTP integration to integrate with the third-party HTTP API. Add the company's API key to the HTTP headers list of the integration request configuration. Correct Answer
  4. Use Amazon API Gateway to create a REST API. Create an AWS Lambda proxy integration. Make calls to the third-party HTTP API from the Lambda function. Pass the company's API key as an HTTP request header.

Key Takeaways

This question tests whether candidates know that API Gateway HTTP integrations can inject static headers server-side, eliminating the need for a Lambda function and keeping costs low while protecting secrets from the browser.

To hide a third-party API key from a public single-page application, use Amazon API Gateway REST API with an HTTP integration that injects the key in the integration request headers. This is the most cost-effective approach because it avoids the compute cost of an AWS Lambda proxy.

Common mistake: Many candidates choose option D (Lambda proxy integration) because it is a familiar pattern for calling external APIs, but it adds unnecessary Lambda invocation cost and complexity compared to a direct HTTP integration.

Expert Analysis

The scenario describes a public SPA that must call a third-party HTTP API using a secret API key. Because the browser is untrusted, the key cannot be embedded in the client code or sent directly from the browser. A server-side component must inject the key before the request leaves AWS.

Option C is correct. A public Amazon API Gateway REST API with an HTTP integration can forward the browser's request directly to the third-party endpoint. In the integration request mapping template, the company's API key is added as a static HTTP header. The key is stored only in the API Gateway configuration, never reaching the client. Because there is no Lambda function, you pay only for API Gateway requests, making this the most cost-effective solution.

Option A is incorrect because a private REST API requires a VPC endpoint (AWS PrivateLink) to be reachable, which adds significant cost and is unnecessary for a public-facing SPA.

Option B is incorrect for the same reason as A (private API + VPC endpoint) and also adds Lambda cost.

Option D works functionally but is not the most cost-effective. A Lambda proxy integration introduces a Lambda invocation for every request, increasing both cost and latency compared to the native HTTP integration mapping available in API Gateway.

Community members correctly note that the private API options (A and B) imply a VPC endpoint, which is not cost-effective, and that Lambda adds unnecessary overhead compared to API Gateway's built-in header mapping.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question asks for the MOST cost-effective serverless solution, always compare native AWS integrations (such as API Gateway HTTP integrations) against Lambda-based solutions first. Native integrations usually win on cost and latency unless custom logic is required.

Community Votes

C
66%
D
34%

66% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. wh1t4k3r 👍 3 Answered C
    Im going with C as per this post: https://stackoverflow.com/questions/62443262/aws-api-gateway-to-external-rest-api I am discarding the use of a private rest api because that would imply a VPC endpoint required and that is not cost effective.
  2. YUICH 👍 3
    C. Amazon API Gateway with REST API and HTTP integration is the best solution because it allows the company to securely add the API key to requests sent to the third-party HTTP API without exposing the API key to the client.
  3. stevesuperdx 👍 3
    C: While D would work, but it introduces extra Lambda overhead, increasing both complexity and cost compared to directly using API Gateway’s HTTP integration.
  4. CloudChingon 👍 1 Answered C
    Correct Answer: C Why Option C Works: Secure: The API key is added server-side in the API Gateway integration, ensuring it is not exposed to users. Cost-Effective: Avoids the cost of running a Lambda function while still using API Gateway for request routing. Public Access: The REST API is publicly accessible to the web client.
  5. tullio85 👍 1 Answered A
    By using a private REST API with an HTTP integration and adding the API key to the HTTP headers list, you can securely forward requests to the third-party API without exposing the API key to the client, while also minimizing costs by avoiding the need for a Lambda function for each request.
Show 2 more comments
  1. jasonczx 👍 1 Answered D
    https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-lambda-proxy-integrations.html
  2. aragon_saa 👍 1 Answered D
    Answer is D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to Log Every Lambda Invocation to an SQS Queue?

S-grade

How to Test Updated Lambda Functions with a Subset of Users Using API Gateway?

S-grade

How to automate S3 object tagging after delayed third-party content audit?

S-grade

How to automatically rotate encryption keys for API keys in serverless apps with no development effort?

S-grade

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide