Apigee API ManagementAuthorCloudBrum editorial teamLast reviewed24 Oct 2026Reading time~12 minLevelBeginner to advanced

• Proxies in front of anythingA proxy wraps a back end, wherever it runs: Cloud Run, GKE, another cloud, a datacenter. Clients see one stable face while the code behind it changes.
• Policies, not codeDozens of ready-made policies cover key checks, OAuth, quotas, spike control, caching and message changes. You wire them into flows with XML.
• Products and developer appsBundle operations into an API product with its own quota, then let developers register apps that receive credentials for it.
• Developer portalsPublish products on an integrated portal, or build a custom one. Developers read the docs, try calls and get their own keys without asking anyone.
• Analytics and debuggingBuilt-in reports break traffic, errors and latency down by product, developer and proxy. A debug session shows each step a live call took.
• Apigee hybridRun the runtime in your own Kubernetes cluster near back ends that can’t leave a datacenter, while managing it from Google Cloud.
• Security toolingAdvanced API Security looks for misconfigured and misused APIs, and API hub keeps a catalogue of every API you own.
• Revisions and environmentsEach change is a numbered revision. Deploy it to an environment such as dev or prod, and roll back by deploying an earlier one.

Organization

The top-level container, tied to a Google Cloud project. Everything else lives inside it: proxies, products, developers, environments.

Environment

A place where proxies run, for example dev or prod. You deploy a proxy revision to an environment.

Environment group

A set of environments reached through the same hostnames, such as api.example.com. It decides which hostname maps to which environments.

Instance

The managed runtime that serves traffic in a Region. An environment must be attached to an instance to serve calls.

API proxy

The façade clients call. It has a proxy endpoint (the client side), a target endpoint (the back-end side) and the flows between them.

Flow

An ordered list of steps that run on a request or a response. PreFlow runs first, conditional flows match certain paths or verbs, and PostFlow runs last.

Policy

A configurable building block, such as VerifyAPIKey, Quota or AssignMessage, that you attach to a step in a flow.

Shared flow

A reusable group of policies that several proxies call, or that runs for every proxy through a flow hook.

API product

A bundle of API resources with access rules and quotas, which developers subscribe to.

Developer and app

A developer is a registered user. An app is what that developer builds, and it receives the keys or OAuth credentials for the products it is approved for.

Target server

A named back-end address that proxies refer to, so moving a back end means changing one setting, not every proxy.

Key value map

A small store for settings or secrets that a proxy reads at run time, kept per environment.

Apigee hybrid

A model where the runtime runs in your own Kubernetes cluster and the management side stays in Google Cloud.

API hub

A catalogue for all your APIs, wherever they run. Each entry holds its spec, its owner and its versions.

Set up Apigee and deploy a first proxy in the Google Cloud console

1. Pick an evaluation or a billing modelFor a first look, create an evaluation organization (free for 60 days). For something permanent, choose pay-as-you-go or a subscription, with a billing account attached.
2. Provision the organizationOpen Apigee in the console and follow the provisioning wizard: project, Region, how the runtime will be reached (VPC peering or Private Service Connect) and the hostname. This can take up to an hour.
3. Check the environment and hostnameThe wizard creates an environment and a group with a hostname. Note the hostname, you will call proxies through it.
4. Create a proxyUnder Proxy development choose Create proxy, pick Reverse proxy, give it a name and a base path such as /orders, and set the target URL of your back end.
5. Add policies to the flowIn the Develop view add policies to the PreFlow: a spike arrest, a key check and a quota are a sensible first set.
6. Deploy a revisionSave and deploy the revision to your environment. The proxy answers on the group’s hostname a minute or so later.
7. Test and debugUse a debug session to watch a call pass through each policy, then call the proxy with curl. Fix the order of steps if a policy fires too late.
8. Create a product, a developer and an appBundle the proxy into an API product with a quota, add a developer, and register an app. Its consumer key is what callers send.
9. Publish and watchPublish the product to a portal, open the analytics dashboard, and add alerts on error rate and latency before real traffic arrives.

• Keep the PreFlow light. Every policy there runs on every call, so put heavy or optional work in conditional flows.
• Use response caching for data that rarely changes, with a cache key that includes what makes responses differ.
• Avoid ServiceCallout to slow services in the main path. Each one adds its latency to every call.
• Keep the runtime close to the back ends, and use an instance in each Region where callers are spread out.
• Set timeouts and connect timeouts on targets sensibly, and use target servers with health monitoring for several back ends.
• Prefer built-in policies to JavaScript or Java callouts, which are slower and harder to maintain.
• Use SpikeArrest to smooth sudden bursts, and Quota for the long-running limit. They do different jobs.
• Watch latency by proxy in the analytics, and use debug sessions to find the slow step.

FinOps is the habit of managing cloud spend together with engineering. These are the FinOps checks that matter most for Apigee API Management.

• Match the billing model to the pattern. Pay-as-you-go suits variable or early use, and a subscription suits steady, high volume.
• Environments and deployments cost money while they exist. Don’t leave extra environments and old proxy deployments running.
• Use the evaluation organization for learning, then delete it.
• Cache and reject early, so bad or repeated calls don’t reach a billed back end.
• Count the extras: external load balancers, Cloud Armor, networking, logging and data transfer.
• Share one organization between teams, with clear environments, instead of running one per team.
• Trim analytics and logging that nobody reads.
• Ask yourself if you need Apigee at all. For a few serverless back ends, API Gateway can cost much less.
• Review the subscription tier and call volume before renewal, and compare it with real usage.
• Use labels and budget alerts on the project that holds the organization.

• Use OAuth 2.0 or JWT verification for end users, and API keys only to identify apps.
• Restrict the back end so it accepts calls only from Apigee, with mutual TLS to the target and private networking.
• Put Cloud Armor and a load balancer in front, and use Private Service Connect for internal callers.
• Keep secrets in encrypted key value maps or Secret Manager, never in the proxy bundle.
• Apply SpikeArrest, Quota and request size limits on every proxy.
• Validate input with schema and size checks, and strip internal headers on the way out.
• Turn on Advanced API Security to find misconfigured and abused APIs, and register APIs in API hub.
• Set least-privilege IAM roles for people who edit proxies, deploy them and read analytics.
• Control developer portal sign-up and require approval for sensitive products.
• Send audit logs to Cloud Logging, and review who changed or deployed what.

Use Cloud Audit Logs to see who changed or deployed a proxy, IAM to separate duties and the Compliance resource centre for Google Cloud’s reports. Responsibility is shared: Google runs the managed platform, and you own the proxies, policies, credentials, data and access.

• Delete environments and portals that nobody uses, along with their old proxies.
• Cache so repeated calls don’t wake the back end.
• Reject abusive traffic at the edge with Cloud Armor, and further in with spike arrest and quotas.
• Place instances in Regions near your users and back ends, and favour lower-carbon Regions where rules allow.
• Log what you will read, with short retention.
• Share one organization among teams rather than running many.
• The Google Cloud Carbon Footprint report shows estimated emissions. Check what it covers for Apigee.

Purchase options

What you actually pay for

• Environments and proxy deployments over time (pay-as-you-go)
• API calls served
• The subscription fee and any volume beyond what it includes
• Add-ons such as Advanced API Security, where charged separately
• Networking and edge: load balancer, Cloud Armor, Private Service Connect and data transfer
• Logging and the infrastructure of an Apigee hybrid cluster

A proxy called orders that spreads calls out, checks an API key and enforces an hourly quota for each app. The gcloud and curl tab imports and deploys the proxy bundle and creates a product, a developer and an app; the Terraform tab adds an environment, a hostname group and a target server; the XML tab is the proxy bundle itself; and the C# tab is a caller that sends the key and backs off when it is limited. It assumes the Apigee organization and instance already exist. Replace the project, hostname and e-mail addresses with your own.

# Assumes an Apigee organization already exists in this project (provision it once in the console) and that an environment called dev is attached to an instance
PROJECT=my-project
ORG=$PROJECT
ENV=dev
API=https://apigee.googleapis.com/v1/organizations/$ORG
TOKEN=$(gcloud auth print-access-token)

gcloud services enable apigee.googleapis.com --project=$PROJECT
gcloud apigee environments list --organization=$ORG

# Zip the proxy bundle (the apiproxy folder from the Proxy XML tab) and import it as a new proxy
(cd orders && zip -r ../orders.zip apiproxy)
curl -s -X POST "$API/apis?name=orders&action=import" \
  -H "Authorization: Bearer $TOKEN" -F "data=@orders.zip"

# Deploy revision 1 to the dev environment
curl -s -X POST "$API/environments/$ENV/apis/orders/revisions/1/deployments" \
  -H "Authorization: Bearer $TOKEN"

# An API product that exposes the proxy in dev, with a quota of 1,000 calls an hour per app
curl -s -X POST "$API/apiproducts" -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{
  "name": "starter", "displayName": "Starter", "approvalType": "auto",
  "environments": ["dev"], "proxies": ["orders"],
  "quota": "1000", "quotaInterval": "1", "quotaTimeUnit": "hour"
}'

# A developer and an app that is allowed to use the product
curl -s -X POST "$API/developers" -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{
  "email": "dev@example.com", "firstName": "Test", "lastName": "Developer", "userName": "testdev"
}'
KEY=$(curl -s -X POST "$API/developers/dev@example.com/apps" -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"name": "test-app", "apiProducts": ["starter"]}' | python3 -c 'import json,sys; print(json.load(sys.stdin)["credentials"][0]["consumerKey"])')

# Call the proxy through the environment group hostname
curl -i -H "x-api-key: $KEY" https://api-dev.example.com/orders/items

# Assumes the Apigee organization and instance already exist (provisioned with VPC peering or Private Service Connect)
variable "org_id" {
  description = "organizations/<project id>"
  type        = string
}

variable "instance_id" {
  description = "Full ID of the existing Apigee instance"
  type        = string
}

resource "google_apigee_environment" "dev" {
  org_id       = var.org_id
  name         = "dev"
  display_name = "Development"
  description  = "Where new revisions are tried first"
}

# The hostname callers use for everything deployed to dev
resource "google_apigee_envgroup" "dev" {
  org_id    = var.org_id
  name      = "dev-group"
  hostnames = ["api-dev.example.com"]
}

resource "google_apigee_envgroup_attachment" "dev" {
  envgroup_id = google_apigee_envgroup.dev.id
  environment = google_apigee_environment.dev.name
}

# An environment only serves traffic once it is attached to an instance
resource "google_apigee_instance_attachment" "dev" {
  instance_id = var.instance_id
  environment = google_apigee_environment.dev.name
}

# The back end, named once so proxies refer to "orders-backend" and not to a URL
resource "google_apigee_target_server" "orders" {
  name        = "orders-backend"
  description = "Orders service on Cloud Run"
  env_id      = google_apigee_environment.dev.id
  protocol    = "HTTP"
  host        = "orders-abc123-el.a.run.app"
  port        = 443
  is_enabled  = true

  s_sl_info {
    enabled = true
  }
}

<!-- apiproxy/orders.xml: the bundle's descriptor -->
<APIProxy name="orders">
    <DisplayName>Orders API</DisplayName>
    <Description>Orders for the mobile app, with key checks and quotas</Description>
</APIProxy>

<!-- apiproxy/proxies/default.xml: the client-facing side -->
<ProxyEndpoint name="default">
    <PreFlow name="PreFlow">
        <Request>
            <Step><Name>Spike-Arrest</Name></Step>
            <Step><Name>Verify-API-Key</Name></Step>
            <Step><Name>Quota-Per-App</Name></Step>
        </Request>
        <Response/>
    </PreFlow>
    <HTTPProxyConnection>
        <BasePath>/orders</BasePath>
    </HTTPProxyConnection>
    <RouteRule name="default">
        <TargetEndpoint>default</TargetEndpoint>
    </RouteRule>
</ProxyEndpoint>

<!-- apiproxy/policies/Spike-Arrest.xml: smooth out sudden bursts (30 a second means about one every 33 ms) -->
<SpikeArrest continueOnError="false" enabled="true" name="Spike-Arrest">
    <Rate>30ps</Rate>
</SpikeArrest>

<!-- apiproxy/policies/Verify-API-Key.xml: the key comes in the x-api-key header -->
<VerifyAPIKey continueOnError="false" enabled="true" name="Verify-API-Key">
    <APIKey ref="request.header.x-api-key"/>
</VerifyAPIKey>

<!-- apiproxy/policies/Quota-Per-App.xml: 1,000 calls an hour for each app -->
<Quota continueOnError="false" enabled="true" name="Quota-Per-App">
    <Allow count="1000"/>
    <Interval>1</Interval>
    <TimeUnit>hour</TimeUnit>
    <Identifier ref="verifyapikey.Verify-API-Key.client_id"/>
    <Distributed>true</Distributed>
    <Synchronous>false</Synchronous>
</Quota>

<!-- apiproxy/targets/default.xml: the back end this proxy forwards to -->
<TargetEndpoint name="default">
    <PreFlow name="PreFlow">
        <Request/>
        <Response/>
    </PreFlow>
    <HTTPTargetConnection>
        <Properties>
            <Property name="io.timeout.millis">10000</Property>
        </Properties>
        <LoadBalancer>
            <Server name="orders-backend"/>
        </LoadBalancer>
        <Path>/</Path>
    </HTTPTargetConnection>
</TargetEndpoint>

// Program.cs: calls the proxy with an API key. If Apigee answers 429 or 503 it waits and tries again, up to four times
using System.Net;

var http = new HttpClient { BaseAddress = new Uri("https://api-dev.example.com/"), Timeout = TimeSpan.FromSeconds(30) };
var apiKey = Environment.GetEnvironmentVariable("APIGEE_KEY") ?? throw new InvalidOperationException("Set APIGEE_KEY first");

HttpResponseMessage response;
var tries = 0;

do
{
    tries++;

    // A request message can only be sent once, so build a fresh one for every attempt
    var request = new HttpRequestMessage(HttpMethod.Get, "orders/items?limit=20");
    request.Headers.Add("x-api-key", apiKey);
    response = await http.SendAsync(request);

    var shouldRetry = response.StatusCode is HttpStatusCode.TooManyRequests or HttpStatusCode.ServiceUnavailable;
    if (!shouldRetry || tries == 4)
    {
        break;
    }

    // A spike arrest clears within seconds, a quota takes longer. Prefer the server's Retry-After, else back off 2, 4, 8 seconds
    var pause = response.Headers.RetryAfter?.Delta ?? TimeSpan.FromSeconds(Math.Pow(2, tries));
    Console.WriteLine($"Got {(int)response.StatusCode}, trying again in {pause.TotalSeconds:0} s (attempt {tries} of 4)");
    await Task.Delay(pause);
}
while (true);

Console.WriteLine(response.IsSuccessStatusCode
    ? await response.Content.ReadAsStringAsync()
    : $"Failed with {(int)response.StatusCode}");

Short walkthrough videos for this service are being prepared. They will appear here and load only when you press play. Until then, follow CloudBrum on YouTube for new videos.

Looking for something lighter? Google Cloud API Gateway fronts Cloud Run, Cloud Functions and App Engine from an OpenAPI file. For plain web traffic, Cloud Load Balancing with Cloud Armor is the usual front door, and Cloud Run functions can serve HTTP on their own.