# API Gateway Backend Security And Rate Limiting

Secures and rate limits backend services behind Google Cloud API Gateway across OpenAPI...

- Repository: https://github.com/google/skills (21764 stars)
- Category: AI and agents
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add google/skills --skill api-gateway-backend-security-and-rate-limiting -g -a claude-code -y`
Codex: `npx skills add google/skills --skill api-gateway-backend-security-and-rate-limiting -g -a codex -y`
Cursor: `npx skills add google/skills --skill api-gateway-backend-security-and-rate-limiting -g -a cursor -y`
Gemini CLI: `npx skills add google/skills --skill api-gateway-backend-security-and-rate-limiting -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add google/skills`

## Description

Secures and rate limits backend services behind Google Cloud API Gateway across OpenAPI 2.0 and OpenAPI 3.0.x API configurations, including MCP-enabled gateways. Use when configuring API key or JWT authentication, locking down Cloud Run or Cloud Run functions backends with a gateway service account, reading authenticated claims from X-Apigateway-Api-Userinfo, setting per-project request quotas, or diagnosing HTTP 429 and HTTP 500 Service Control Quota errors. Do not use for Apigee, GKE Gateway API, Cloud Load Balancing custom domain setup, or LLM model routing.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# API Gateway Backend Security and Rate Limiting

This skill configures client authentication, gateway-to-backend authentication, and per-project rate limits (quotas) for Google Cloud API Gateway across OpenAPI 2.0 (`swagger: "2.0"`) and OpenAPI 3.0.x (`openapi: 3.0.4`), including gateways with Model Context Protocol (MCP) enabled (Public Preview).

## Attribution

**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you
MUST read [Usage Attribution](references/attribution.md). For commands executed
directly in the terminal (never in generated scripts, Terraform, or user code),
prefix `gcloud` with
`CLOUDSDK_METRICS_REQUEST_ATTRIBUTION="agent-skills/1.0 (skill:api-gateway-backend-security-and-rate-limiting)"`
and append `agent-skills/1.0 (skill:api-gateway-backend-security-and-rate-limiting)` to `User-Agent` headers.

## Prerequisites

The rest: https://github.com/google/skills/blob/HEAD/skills/cloud/api-gateway-backend-security-and-rate-limiting/SKILL.md