CodeParkUse HTTP APIs by default: they are cheaper and simpler. Use REST APIs when you need their extra features.
HTTP APIs are the newer, simpler type. They cost less and have lower latency. They support native JWT authorizers. A JWT authorizer checks tokens from any OIDC provider, such as Cognito or Auth0, without custom code. HTTP APIs also support Lambda authorizers and IAM auth.
REST APIs have more features:
- API keys with usage plans, for per-client quotas.
- Request validation.
- Request and response mapping (changing the shape of the data).
- Response caching.
- AWS WAF integration.
- Private endpoints.
For auth, REST APIs offer Cognito user pool authorizers, Lambda authorizers and IAM.
A Lambda authorizer runs your own function to check a token or header. It returns an IAM policy or a simple allow. API Gateway can cache its result, so it calls the function less often.
In short: pick HTTP APIs for JWT-protected Lambda or HTTP backends. Pick REST APIs when you need usage plans, WAF, caching or transformations.
- HTTP APIs are cheaper and have lower latency, but fewer features.
- HTTP APIs have native JWT authorizers for OIDC providers.
- REST APIs add usage plans, API keys, validation, mapping, caching, WAF and private endpoints.
- REST APIs authenticate with Cognito authorizers, Lambda authorizers or IAM.
- Lambda authorizers run your own logic and can cache their results.