Rate limit api based on a bearer token instead of apikey

You can achieve this by using a Lambda authorizer. When you do, you have the option to define the API key is retruned from the Lambda function. In there you can translate the token into an API Key. You will need to add the API keys to API Gateway and associate them with usage plans.

Hello, you can use authorizer-sourced API keys [1] to achieve this use case. Unlike reading the API key from the client headers, the authorizer lambda function will perform your custom logic on the Bearer Token and decide if the API key is to be provided or not for the request that ultimately decides if usage plan is applied or not. You can follow below steps for the same:

1. Create an API and its required methods, resources and deploy it.
2. Create an API key.
3. Create a Usage Plan and associate it with the API Stage and the API Key created in step2.
4. Navigate to the API settings and change the API key source [2] to “AUTHORIZER”. Scroll down and save the changes.
5. Create a Token Based Lambda authorizer whose logic with decide if the request is authenticated (hence, applying the usage plan) and accordingly add the “usageIdentifierKey” parameter in the authorizer returned response. The request is executed only if the usageIdentifierKey is present in the root level of the authorizer returned JSON object [3].
6. For the required API methods, configure the method request for Lambda authorizer and API keys.
7. Deploy the API again to the same stage as in step1.
8. Call the API with the appropriate bearer token and observe the output (“forbidden”/“limit exceeded”/expected output of successful execution).

References: [1] https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-api-key-source.html#:~:text=To%20use%20authorizer%2Dsourced%20API%20keys%3A

[2] https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-api-key-source.html

[3] https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-lambda-authorizer-output.html#:~:text=If%20the%20API%20uses%20a%20usage%20plan

[+] https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html#api-gateway-lambda-authorizer-create:~:text=Lambda%20authorizer%20function-,To,-create%20a%20token