Answers: <p>Besides setting <code>API Key Required = false</code>, I was missing something in <code>API Gateway</code> <code>&gt;</code> <code>Custom domain names</code>:</p>
  <p>The API Mapping had no stage selected. When I selected <code>dev</code>, the endpoint worked.</p>
  <p><a href="https://i.sstatic.net/VVOS3.png" rel="noreferrer"><img src="https://i.sstatic.net/VVOS3.png" alt="Api Gateway Mappings" /></a></p>
  
Answers: CC BY-SA 4.0
Answers: 2022-06-24T22:51:50.630Z
Answers: 2022-06-24T22:51:50.630Z
Answers: soniaseguz
Answers: <blockquote>
  <p>When you deploy an edge-optimized API, API Gateway sets up an Amazon CloudFront distribution and a DNS record to map the API domain name to the CloudFront distribution domain name. Requests for the API are then routed to API Gateway through the mapped CloudFront distribution.</p>
  </blockquote>
  <p>Source: API Gateway documentation — <a href="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-custom-domains.html#edge-optimized-custom-domain-names" rel="nofollow noreferrer">Edge-optimized custom domain names</a>.</p>
  <hr />
  <p>To allow calls to a method of a resource in your API without API key, set its <code>API Key Required</code> setting to <code>false</code>:</p>
  <p><a href="https://i.sstatic.net/NNkLS.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/NNkLS.png" alt="enter image description here" /></a></p>
  
Answers: CC BY-SA 4.0
Answers: 2020-07-18T14:32:06.953Z
Answers: thank you @Harish KM! I've changed the API type to regional, but still the API remains closed. At least half of my question is now answered. :-)
Answers: Ta Mu
Answers: CC BY-SA 4.0
Answers: 2020-07-19T06:53:27.283Z
Answers: @PeterMuryshkin I've updated the answer to show how to make the API accept a call without an API key.
Answers: Harish KM
Answers: CC BY-SA 4.0
Answers: 2020-07-19T09:36:06.477Z
Answers: thank you, Harish! Your hint has helped me in the right direction though I couldn't find the setting edit option in the UI, possibly with ANY selector it's different mode.
Answers: Ta Mu
Answers: CC BY-SA 4.0
Answers: 2020-07-19T11:04:33.197Z
Answers: @PeterMuryshkin Click `Method Request` to get to the settings, as shown [here](https://i.imgur.com/lOxYoGj.png).
Answers: Harish KM
Answers: CC BY-SA 4.0
Answers: 2020-07-19T13:01:08.373Z
Answers: I see now! thx.
Answers: Ta Mu
Answers: CC BY-SA 4.0
Answers: 2021-06-16T22:33:35.900Z
Answers: I am still having this issue after I changed the `API Key Required` property to `false`.  Any ideas?
Answers: Jeremy Hamm
Answers: CC BY-SA 4.0
Answers: 2021-06-17T04:02:46.760Z
Answers: @JeremyHamm Remember to save the change by clicking the tiny tick mark next to `API Key Required` after you change it from `true` to `false`. Also remember to deploy the API to a stage before testing it: `Actions` menu > `Deploy API`.
Answers: Harish KM
Answers: CC BY-SA 4.0
Answers: 2020-07-18T14:31:01.113Z
Answers: 2020-07-19T06:50:21.157Z
Answers: 2020-07-19T06:50:21.157Z
Answers: Harish KM
Body: <p>How can happen that with a Lambda/API Gateway combination, if no explicit Cloud Front configuration has been done, in an error response header they mention CloudFront?</p>
  <pre><code>header: x-amzn-ErrorType: ForbiddenException
  header: x-amz-apigw-id: P3mmbT_DREF8bg=
  header: X-Cache: Error from cloudfront
  </code></pre>
  <p>Actual problem: with a disabled API key, API keeps responding &quot;forbidden&quot;.</p>
  <p>UPDATE. As it seems the problem is not related to the Edge API/CloudFront, as the problem with disabled key persists also on changing API type to regional.</p>
  <p>UPDATE. I can now disable API key checking as suggested by @Harish i.e. it's not about disabling the API key itself but telling the API whether it's required or not.</p>
  <p>What is yet open though is why if created by <a href="https://github.com/Miserlou/Zappa" rel="nofollow noreferrer">Zappa</a>, there is no option to change this setting in the UI, because there are not single methods.</p>
  <p><a href="https://i.sstatic.net/8tFRY.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/8tFRY.png" alt="zappa-methods" /></a></p>
  
Comments: CC BY-SA 4.0
Comments: 2020-07-18T15:59:23.590Z
Comments: What response do you expect from the API when you call it with a disabled API key?
Comments: Harish KM
Comments: CC BY-SA 4.0
Comments: 2020-07-18T16:25:02.790Z
Comments: the client sends no key, the API has it disabled. So my expectation is that API accepts the call normally.
Comments: Ta Mu
Comments: CC BY-SA 4.0
Comments: 2020-07-19T14:51:42.843Z
Comments: Use [Zappa's `api_key_required` setting](https://github.com/Miserlou/Zappa#api-key) to enable/disable API key requirement for individual routes in your API.
Comments: Harish KM
Tags: <amazon-web-services><amazon-cloudfront>
Title: AWS API Gateway: 403 forbidden with disabled API key; error from cloudfront
UserDisplayName: Ta Mu
ThreadText: # AWS API Gateway: 403 forbidden with disabled API key; error from cloudfront
  
  (Asked by: username_0 on 2020-07-18)
  
  How can happen that with a Lambda/API Gateway combination, if no explicit Cloud Front configuration has been done, in an error response header they mention CloudFront?
  
  ```
  header: x-amzn-ErrorType: ForbiddenException
  header: x-amz-apigw-id: P3mmbT_DREF8bg=
  header: X-Cache: Error from cloudfront
  
  ```
  
  Actual problem: with a disabled API key, API keeps responding "forbidden".
  
  UPDATE. As it seems the problem is not related to the Edge API/CloudFront, as the problem with disabled key persists also on changing API type to regional.
  
  UPDATE. I can now disable API key checking as suggested by @username_1 i.e. it's not about disabling the API key itself but telling the API whether it's required or not.
  
  What is yet open though is why if created by [Zappa](https://github.com/Miserlou/Zappa), there is no option to change this setting in the UI, because there are not single methods.
  
  [![zappa-methods](https://i.sstatic.net/8tFRY.png)](https://i.sstatic.net/8tFRY.png)
  
  **Tags:** amazon-web-services, amazon-cloudfront
  
  > **Comments:**
  > **username_1**: What response do you expect from the API when you call it with a disabled API key?  
  > **username_0**: the client sends no key, the API has it disabled. So my expectation is that API accepts the call normally.  
  > **username_1**: Use [Zappa's `api_key_required` setting](https://github.com/Miserlou/Zappa#api-key) to enable/disable API key requirement for individual routes in your API.  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2020-07-18. Score: 3 | Accepted answer
  
  > When you deploy an edge-optimized API, API Gateway sets up an Amazon CloudFront distribution and a DNS record to map the API domain name to the CloudFront distribution domain name. Requests for the API are then routed to API Gateway through the mapped CloudFront distribution.
  
  Source: API Gateway documentation — [Edge-optimized custom domain names](https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-custom-domains.html#edge-optimized-custom-domain-names).
  
  ---
  
  To allow calls to a method of a resource in your API without API key, set its `API Key Required` setting to `false`:
  
  [![enter image description here](https://i.sstatic.net/NNkLS.png)](https://i.sstatic.net/NNkLS.png)
  
  > **Comments:**
  > **username_0**: thank you @username_1! I've changed the API type to regional, but still the API remains closed. At least half of my question is now answered. :-)  
  > **username_1**: @PeterMuryshkin I've updated the answer to show how to make the API accept a call without an API key.  
  > **username_0**: thank you, username_1! Your hint has helped me in the right direction though I couldn't find the setting edit option in the UI, possibly with ANY selector it's different mode.  
  > **username_1**: @PeterMuryshkin Click `Method Request` to get to the settings, as shown [here](https://i.imgur.com/lOxYoGj.png).  
  > **username_0**: I see now! thx.  
  > **username_3**: I am still having this issue after I changed the `API Key Required` property to `false`.  Any ideas?  
  > **username_1**: @username_3 Remember to save the change by clicking the tiny tick mark next to `API Key Required` after you change it from `true` to `false`. Also remember to deploy the API to a stage before testing it: `Actions` menu > `Deploy API`.  
  
  ---
  
  ### Answer by username_2 on 2022-06-24. Score: 5
  
  Besides setting `API Key Required = false`, I was missing something in `API Gateway` `>` `Custom domain names`:
  
  The API Mapping had no stage selected. When I selected `dev`, the endpoint worked.
  
  [![Api Gateway Mappings](https://i.sstatic.net/VVOS3.png)](https://i.sstatic.net/VVOS3.png)
  
  
  ---
  
  