Skip to content
Weik.ioUniversity
Try Weik.io

Open it to a caller: a key and a limit

APIM 2 · 3:08

A named caller gets an API key and a rate limit in place of anonymous access, and the gateway turns away calls over the limit. The video also rotates a leaked key and disables and enables a caller.

Download the mp4Recorded on 2026.2

What it covers

  • Deleting the anonymous subscription, which closes the API to callers without a key
  • An API key subscription for partner-x with a limit of 60 calls a minute
  • Calling with the key in the X-Api-Key header
  • Sending 61 calls in a burst, and the 429 that the gateway returns for the call over the limit
  • Rotating a leaked key with weikio subscription rotate-key, and disabling and enabling a caller
  • The Subscriptions section on the API's page in the admin UI

Commands in this video

Terminal
$ weikio delete subscription finance/first-look --env production
$ weikio subscription create finance/partner-x --env production --api invoices --type apikey --rate-limit 60/60s
$ curl http://api.example.com/invoices/1.0/orders/42 -H "X-Api-Key: $API_KEY"
$ for i in $(seq 1 61)
do
  curl -s -o /dev/null -w '%{http_code}\n' http://api.example.com/invoices/1.0/orders/42 -H "X-Api-Key: $API_KEY"
done
$ weikio subscription rotate-key finance/partner-x --env production
$ weikio subscription disable finance/partner-x --env production
$ weikio subscription enable finance/partner-x --env production
Transcript
  1. 0:02Video one left the API open to anyone.
  2. 0:05This video closes that door and gives a named caller a key and a rate limit.
  3. 0:14The gateway is serving invoices in production, on api.example.com.
  4. 0:19And it is open to anyone, because of an anonymous subscription.
  5. 0:23This video closes that door.
  6. 0:31First the open door closes.
  7. 0:33A subscription says who may call an API in one environment.
  8. 0:38Deleting it stops its caller.
  9. 0:42Here is the subscription's document.
  10. 0:45This one is for partner-x.
  11. 0:47Its type says the caller authenticates with an API key.
  12. 0:51And its rate limit is 60/60s, 60 calls a minute.
  13. 1:02Creating it in production asks first.
  14. 1:05A yes stores the document in production.
  15. 1:08The key is minted and printed once.
  16. 1:10Only its hash is stored, so it cannot be printed again.
  17. 1:17Now partner-x calls with its key in the X-Api-Key header.
  18. 1:21The gateway admits it, forwards the call, and the same JSON answer comes back.
  19. 1:29Now a burst over the limit.
  20. 1:31The gateway's own limiter answers 429, before anything is forwarded.
  21. 1:37A subscription lives in one environment,
  22. 1:40so a devtest key never opens a production host name.
  23. 1:44The body is empty, because the gateway turned the call away.
  24. 1:53When a key leaks, rotate-key prints a new one once.
  25. 1:57The old key stops at the next route-table swap.
  26. 2:00And the caller is given the new key and calls with it.
  27. 2:05To shut a caller out without deleting anything: disable.
  28. 2:10Enable brings it back.
  29. 2:20The admin UI keeps the same page for the API.
  30. 2:24Its subscriptions section lists partner-x: type apikey, rate limit 60/60s.
  31. 2:33The row groups by environment, so production is its own group.
  32. 2:42Here is the whole picture.
  33. 2:44The anonymous door closed, and partner-x has a key and a limit.
  34. 2:49Over the limit, the call got 429, and a leaked key is replaced, never printed.
  35. 2:55And a subscription can be switched off, and on again.

Next in this track

APIM 3 · 3:14 Watch the calls Watched