How much does throttling actually inflate API Gateway costs?

AWS API Gateway throttles at the account-level rate limit (default 10,000 rps per region). When a request is throttled (HTTP 429), the Gateway still counts it as a billable request — and the client typically retries, often with exponential backoff. The amplification factor: if 10% of requests are throttled and each throttled request triggers 2 retries, the effective request volume is 1.3× nominal. At 1,000 nominal rps with 10% throttling and 2 retries each, Gateway bills for 1,000 + 200 = 1,200 rps (accounting for throttled requests + client retries). In a cascading throttle scenario where retried requests also get throttled (retry storms), the amplification can reach 2-3× nominal volume. The double hit: you pay for the throttled request (Gateway processed it to return 429), and you pay for the retry (which may also get throttled). The fix: set per-client rate limits at the Gateway level (usage plans + API keys), not just account-level limits, and design clients with jittered exponential backoff + circuit breakers that stop retrying after 3 consecutive 429s.

How much bandwidth does gRPC save vs REST for API traffic?

gRPC with Protobuf serialization reduces payload size by 40-60% compared to REST with JSON for the same data. For a typical API response: a JSON payload with field names, quotes, and whitespace might be 10 KB. The same data in Protobuf binary encoding is 3-4 KB. At 500M requests/month: JSON = 5 TB of response data; Protobuf = 2 TB. At AWS data transfer rates ($0.09/GB for the top tier), the bandwidth saving is $270/month in egress alone. gRPC's additional benefits for cost: HTTP/2 multiplexing reduces connection overhead (fewer TLS handshakes = lower latency), and Protobuf schema validation catches malformed requests before they reach your backend (eliminating 400-error processing costs). The tradeoffs: gRPC requires client-side stub generation (protoc compilation step), has limited browser-native support (requires gRPC-Web proxy), and is harder to debug (curl doesn't speak Protobuf). For internal service-to-service communication, gRPC is the correct default — the bandwidth, latency, and schema enforcement benefits are unambiguous. For public-facing APIs consumed by third-party developers, REST+JSON remains the compatibility default despite the bandwidth premium.

Why does multi-region API Gateway deployment fragment costs so aggressively?

Azure API Management charges a flat base fee per instance per region: Standard tier at ~$400/month per instance. Deploying in 5 regions for global low-latency access costs $2,000/month in base fees before a single API call. AWS API Gateway has no base fee (pure per-request), but each regional endpoint is a separate Gateway with its own throttling limits, caching configuration, and CloudWatch metric costs. At 5 regions with 100M requests/month each: AWS's per-request costs multiply by 5 for the same workload served regionally. The alternative: a single-region Gateway behind a global CDN (CloudFront with regional edge caches) serves global traffic from one Gateway endpoint, paying CDN egress rates ($0.085/GB) instead of multi-region Gateway fragmentation. For read-heavy APIs with cacheable responses, CDN caching at the edge eliminates 60-90% of Gateway requests entirely — each cached response is served from the CDN edge, not the Gateway. This is the single-largest cost optimization for public APIs: cache at the CDN, not at the Gateway. Use the API Rate Limit Cost Calculator at jslet.com/api-rate-limit-cost to model multi-region vs CDN-fronted architectures.

What's the cheapest way to protect an API from abuse without paying per-request for WAF?

AWS WAF on API Gateway costs $5/month per web ACL + $1/month per rule + $0.60 per million requests inspected. At 500M requests/month: $300/month just for WAF request inspection — often exceeding the Gateway request cost. The cheapest abuse protection stack: (1) CloudFront in front of the Gateway with AWS WAF at the CloudFront level — CloudFront WAF costs the same per-request but CloudFront caches responses and absorbs DDoS traffic before it reaches the Gateway. At 80% cache hit rate, only 100M of 500M requests reach the Gateway, and WAF inspects all 500M at CloudFront (cost unchanged) but the Gateway bill drops by 80%. (2) Rate limiting at the Gateway itself via usage plans + API keys — free, built into API Gateway, blocks abusive clients before WAF even evaluates. (3) For DDoS volumetric protection, AWS Shield Standard is free and included with CloudFront — covers SYN floods, UDP reflection, and HTTP request floods at the network edge. Shield Advanced at $3,000/month adds cost-protection insurance (refunds for scaling costs incurred during a Shield-mitigated attack) and is worth it only if your clean traffic exceeds 100 Gbps and a sustained DDoS could generate $50K+ in CloudFront/Gateway scaling costs.

The Rate Limit Racket

Q: At what request volume should I switch from managed API Gateway to self-hosted?

The breakeven between managed API Gateway and self-hosted NGINX/Kong occurs at roughly 500 requests/second sustained. At 500 rps (1.3B requests/month): AWS REST API Gateway costs roughly $4,550/month (requests) + data transfer. Self-hosted on a c6i.xlarge reserved instance (3-year RI at $66.24/month) with a second instance for HA ($132.48/month total) handles the same throughput with zero per-request charges and zero egress charges (traffic stays within the VPC). The managed Gateway's per-request pricing is linear with volume; self-hosted compute is fixed. Below 100 rps, managed Gateway wins on operational simplicity. Above 1,000 rps, the self-hosted savings exceed $10,000/month — and the operational overhead of running two NGINX instances is justified. Use the API Rate Limit Cost Calculator at jslet.com/api-rate-limit-cost to model the breakeven for your exact traffic profile across AWS, GCP, Azure, and self-hosted options.

Why Your API Gateway Bills $400/Month for What NGINX Does on a $124 Server — And The Five Cost Multipliers The Pricing Page Hides

Published: 2026-07-26 | jslet Research | 15 min read | Classification: Unrestricted

Executive Summary

API Gateway pricing pages all lead with the same number: dollars per million requests. AWS REST API Gateway: $3.50/M. AWS HTTP API Gateway: $1.00/M. GCP API Gateway: $3.00/M. These numbers create a mental model where cost = request volume × per-request rate. The model is wrong. The per-request rate is the smallest line item on a production API Gateway bill. The real cost drivers — data transfer egress, throttling retry amplification, multi-region instance fragmentation, and protocol overhead — each multiply the per-request cost by a factor of 2-10×. Together they produce bills where the per-request rate accounts for less than 20% of the total.

This briefing deconstructs the five cost multipliers, provides the self-hosted vs managed breakeven model across AWS, GCP, and Azure, and shows why a $124/month NGINX instance can replace a $4,000/month API Gateway bill for the same traffic — with lower latency and zero per-request charges.

Multiplier 1: Data Transfer — The Line Item Bigger Than Requests

API Gateway data transfer pricing is buried three scrolls down on the pricing page. AWS API Gateway charges $0.09/GB for the first 10 TB, then $0.085/GB up to 50 TB. At 500M requests/month with a 10 KB average request body and 50 KB average response: (10 + 50) × 500M = 30 TB/month of data transfer. At $0.085/GB (tiered rate): $2,550/month in egress. The request cost for 500M at $1.00/M (HTTP API): $500/month. Data transfer is 5.1× the request cost. At 1 KB request + 100 KB response: egress jumps to $4,295/month — 8.6× the request cost.

The per-request rate is the decoy. Data transfer is the hook. This is true across all providers: AWS, GCP, and Azure all charge separately for data transfer through the Gateway, and the egress rate ($0.05-0.12/GB depending on tier and provider) dominates the bill at any response size above ~10 KB. For APIs serving images, documents, large JSON payloads, or unoptimized responses with verbose field names — the data transfer cost alone exceeds all other line items combined.

Multiplier 2: Throttling Retry Amplification

When a client gets an HTTP 429 from the API Gateway, the Gateway counts it as a billable request. The client then retries — typically 2-3 times with exponential backoff. Each retry is another billable request. At 10% throttling rate with 2 retries per throttled request: effective request volume is 1.3× nominal. In a cascading scenario — where retries push the Gateway further over its rate limit, causing more 429s, causing more retries — the amplification can hit 2-3×. You pay for the throttled request (Gateway processed it to determine "rate limit exceeded"), you pay for the retry request, and if that retry is also throttled, you pay for the second 429 and the third attempt. Four billable requests for one successful client transaction.

The 429 response itself is small (~200 bytes), so the per-request cost on a throttled request is minimal — but the amplification effect on the total request count is not. A 100M-request/month API with 15% throttle rate and 2× amplification is actually handling 130M billable requests. At $1.00/M requests (HTTP API): $130/month instead of $100 — a 30% increase from throttling alone. The fix: per-client rate limiting via API keys + usage plans, and clients that implement circuit breakers (stop retrying after 3 consecutive 429s from the same endpoint).

Multiplier 3: Protocol Choice As A Cost Lever

REST+JSON is the default. gRPC+Protobuf is 40-60% smaller on the wire. At 500M requests/month with 50 KB JSON responses: 25 TB egress. Same data in Protobuf: 10-15 TB. At $0.085/GB: JSON egress costs $2,125/month. Protobuf egress costs $850-1,275/month. The protocol choice saves $850-1,275/month in data transfer alone — plus the latency reduction from fewer bytes over the wire. WebSocket persistent connections add a different cost dynamic: the connection stays open, eliminating TLS handshake overhead per-request, but the Gateway bills for the connection duration. For high-frequency, small-payload workloads (trading data, chat, live scores), WebSocket eliminates the per-request data transfer overhead and is structurally cheaper. For infrequent, large-payload workloads (file upload, batch processing), REST with HTTP/2 multiplexing is the sweet spot. The protocol is not just an engineering choice. It's a cost-structure choice. Model the difference with the API Rate Limit Cost Calculator.

Multiplier 4: Multi-Region Fragmentation

Azure API Management charges per-instance base fees: Standard tier at ~$400/month per instance. Deploying in 5 regions for global low-latency: $2,000/month before a single API call. AWS API Gateway has no base fee, but each regional endpoint is a separate Gateway — 5 regions means 5 separate rate limits to manage, 5 sets of CloudWatch metrics, 5 configurations to keep in sync. The cost fragmentation is not just monetary — it's operational. A single-region Gateway behind a global CDN (CloudFront) serves the same global traffic from one endpoint. At 80% CDN cache hit rate, the Gateway sees only 20% of requests. A 500M request/month API with 80% cacheable responses: 100M Gateway requests ($100-350/month depending on Gateway type), 400M CDN cache serves (included in CloudFront egress pricing at $0.085/GB for the cached responses). Total: $100-350 Gateway + CDN egress on 400M × avg response size. The CDN-fronted architecture is almost always cheaper than multi-region Gateway deployment — and it's simpler to operate.

Multiplier 5: The Self-Hosted Breakeven

The mathematical breakeven between managed API Gateway and self-hosted NGINX: compute cost of NGINX ≤ per-request + data-transfer cost of managed Gateway. A c6i.xlarge reserved instance (3-year RI, $66.24/month) running NGINX handles ~5,000-10,000 rps for typical API workloads (connection proxying, basic header manipulation, rate limiting via limit_req). At 5,000 rps sustained: 13B requests/month. AWS HTTP API Gateway: $13,000/month in request costs alone, plus data transfer. NGINX on c6i.xlarge: $66.24/month. HA pair: $132.48/month. The self-hosted option is 98% cheaper — and the data transfer is free because NGINX is inside your VPC talking to your backend services over private IPs.

The breakeven is not at 5,000 rps. It's at roughly 500 rps. At 500 rps (1.3B requests/month): HTTP API Gateway = $1,300/month request cost + data transfer. Two c6i.xlarge RIs in HA = $132.48/month + negligible operational overhead if you use an AMI or container image with pre-configured NGINX. The managed Gateway "simplicity premium" is worth $1,167/month at this scale — and the question is whether your team's operational capacity justifies spending $14,000/year to avoid managing two NGINX instances. For many teams, the answer shifts from "managed is worth it for simplicity" to "we can manage this" somewhere between 200 and 500 rps.

Concrete Steps: The API Gateway Cost Audit

1. Pull data transfer as a separate line item from your AWS bill. AWS Cost Explorer → filter by Service = "API Gateway" → group by Usage Type. You'll see "APIGateway-Requests" and "APIGateway-DataTransfer-Out-Bytes." The ratio of data transfer cost to request cost tells you whether response optimization (compression, field trimming, protocol change) will move the needle. If data transfer > 2× request cost: optimize responses first. If request cost > 2× data transfer: consolidate endpoints or evaluate self-hosted.

2. Calculate your throttling amplification factor. CloudWatch metric: 4XXError count / Request count. If 4XX errors > 2% of total requests and most are 429s, throttling is amplifying your bill. Implement per-client rate limits via usage plans. Add a circuit breaker to your client SDKs.

3. Run the CDN-fronted vs multi-region Gateway comparison. If your API has cacheable GET responses (>60% of traffic is GET), a single-region Gateway behind CloudFront with caching enabled typically cuts Gateway costs by 60-80%. Spend 30 minutes configuring cache behaviors and TTLs.

4. Test gRPC for internal service-to-service paths. If you have backend microservices calling each other through the Gateway (which is an anti-pattern but common in lift-and-shift migrations), move them to direct VPC communication or gRPC. The Gateway is for external traffic. Internal traffic through the Gateway pays the per-request tax on every inter-service call — easily the most expensive RPC mechanism in your architecture.

5. Model the self-hosted breakeven at your actual traffic volume. Use the API Rate Limit Cost Calculator to compare managed Gateway vs self-hosted across all three clouds. If your sustained traffic exceeds 500 rps and you have an operational team that manages EC2 instances or containers, self-hosted NGINX or Kong will save $10,000-100,000/year.

Frequently Asked Questions

At what request volume should I switch from managed API Gateway to self-hosted?

The breakeven occurs at roughly 500 requests/second sustained. Below 100 rps: managed Gateway wins on operational simplicity. At 500 rps: self-hosted NGINX on two c6i.xlarge RIs ($132.48/month HA) costs 90% less than AWS HTTP API Gateway ($1,300/month + data transfer). Above 1,000 rps: the savings exceed $10,000/month and self-hosted is the only rational economic choice. The operational overhead is managing two EC2 instances — the same operational capability required to run any production backend. Use the API Rate Limit Cost Calculator to model your exact numbers.

Does throttling actually cause a measurable cost increase on API Gateway?

Yes. Each 429 response is a billable request. Each client retry is another billable request. At 15% throttle rate with 2× retry amplification: a 100M-request/month API actually bills 130M requests — 30% more than nominal. The fix: per-client rate limiting (API keys + usage plans) prevents abusive clients from consuming the shared rate limit, and client-side circuit breakers stop retries after 3 consecutive failures. These are configuration changes, not architecture changes — 30 minutes of CloudFormation work to save 20-30% on monthly Gateway bills for throttled APIs.

gRPC vs REST vs WebSocket — which protocol is cheapest on API Gateway?

gRPC with Protobuf is cheapest in data transfer (40-60% smaller payloads than JSON), but AWS API Gateway's native gRPC support is limited to HTTP API Gateway only. REST with HTTP/2 and compressed JSON (gzip/brotli at the Gateway level) closes most of the gap. WebSocket is cheapest for high-frequency, small-payload workloads (trading, live scores, chat) because it eliminates per-connection TLS handshake overhead. Pick the protocol based on workload shape, not per-byte cost: request-response = REST+gzip, service-to-service = gRPC, persistent bidirectional streams = WebSocket. Use the API Rate Limit Cost Calculator to toggle between protocols and see the cost impact.

How do I reduce multi-region API Gateway costs without sacrificing global latency?

Put a single-region Gateway behind CloudFront with regional edge caches. CloudFront has 600+ points of presence globally — your API traffic hits the nearest PoP, cached responses are served from the edge (0ms Gateway latency, 0 Gateway requests), and only cache misses reach the origin Gateway. For read-heavy APIs (GET > 60% of traffic), this cuts Gateway request volume by 60-80%. The CDN egress cost is $0.085/GB (CloudFront) vs the Gateway egress cost of $0.09/GB — similar per-GB, but 80% fewer bytes flowing through the Gateway. Multi-region Gateway deployment should be reserved for write-heavy, non-cacheable APIs where low-latency write path to the nearest region is the primary requirement.

What's the cheapest WAF/DDoS protection for a public API?

CloudFront + AWS WAF ($5/month per Web ACL + $1/month per rule + $0.60/M requests) + AWS Shield Standard (free, included with CloudFront). At 500M requests/month, WAF inspection costs $300/month. CloudFront caches responses: at 80% cache hit rate, only 100M requests reach the Gateway, reducing Gateway request costs by 80%. The WAF inspects all 500M requests at CloudFront ($300/month), the Gateway handles the 100M cache misses. Shield Standard provides free L3/L4 DDoS protection. Shield Advanced ($3,000/month) is only justified if your clean traffic exceeds 100 Gbps and a sustained volumetric attack could generate 6-figure CloudFront/Gateway scaling bills — Shield Advanced provides cost-protection insurance (AWS refunds scaling costs during a Shield-mitigated attack).

Methodology & Disclosure

Pricing data from publicly available cloud provider rate cards accessed in July 2026. AWS API Gateway: REST $3.50/M requests, HTTP $1.00/M requests. GCP API Gateway: $3.00/M requests. Azure API Management: Standard tier $400/month/instance + $2.00/M requests. Data transfer: AWS $0.09/GB (first 10 TB), GCP $0.12/GB (first 1 TB), Azure $0.087/GB (first 10 TB). All pricing us-east-1 (or equivalent primary region). Self-hosted compute: c6i.xlarge 3-year Standard RI at $66.24/month (us-east-1).

Disclosure: jslet is an independent research project. This analysis was produced using our own API Rate Limit Cost Calculator and publicly available cloud pricing data. We are not sponsored by any cloud provider.

References & Further Reading

AWS (2026). "API Gateway Pricing." aws.amazon.com
GCP (2026). "API Gateway Pricing." cloud.google.com
Azure (2026). "API Management Pricing." azure.microsoft.com
AWS (2026). "Throttling API requests for better throughput." docs.aws.amazon.com
gRPC (2026). "gRPC vs REST — Performance benchmark." Protobuf serialization benchmarks, HTTP/2 multiplexing vs HTTP/1.1 comparison. grpc.io
NGINX (2026). "NGINX as an API Gateway." Rate limiting, authentication, and routing configuration. nginx.com
AWS (2026). "CloudFront Pricing." aws.amazon.com

📜 Copyright & Attribution

Sharing & Reprinting: You may share excerpts (up to 200 words) with a mandatory, do-follow link back to this article's canonical URL.

Preferred Attribution Format: "The Rate Limit Racket (2026)" — jslet Research, July 2026. https://www.jslet.com/api-rate-limit-cost-real

📡 Enjoyed this? When the per-request rate is 20% of your bill and data transfer is 80%, the pricing page misled you. RSS covers one pricing-model reality check per week. No vendor sponsors. RSS Feed → | More options →