API Gateway REST API returns “Resource forbidden due to invalid API Key” even though key is enabled and stage is attached

The error "Resource forbidden due to invalid API Key" occurs when API Gateway can't match the API key you're sending with a Usage Plan that is mapped to the correct API + Stage. Even if the key is enabled and the usage plan looks attached, the issue is almost always due to one of these configuration gaps:

1. The Usage Plan does not include your API + Stage

In the API Gateway console, open your Usage Plan → Associated API Stages. Make sure it contains an entry like:

<API_ID> / <stage_name>

If this mapping is missing, API Gateway has no way to link your request to the usage plan, and the key will be rejected.

Add the API + stage to the plan and redeploy your API.

2. The API key is not added to the Usage Plan (Most common issue)

An API key by itself does not grant access. It must be explicitly attached to the Usage Plan, and only keys listed in that plan are treated as valid for the mapped API stage.

How to confirm:

• Go to API Gateway Console → API Keys → (your key)
• Check the Usage Plans section
• You must see the usage plan listed there

If the key is not attached, API Gateway treats it as invalid, even if:

• the key is enabled
• the stage requires an API key
• the usage plan is mapped correctly

Attach the key to the usage plan and test again.

3. The method was configured to require an API key but the stage was not redeployed

After enabling "API Key Required" at the method level, you must redeploy the API to the same stage. Any changes made without redeploying won't be applied.

4. Wrong API key being used in the request

Verify that the exact key value attached to the usage plan is the one being sent. (HTTP headers are case-insensitive, so both x-api-key and X-Api-Key work.)

5. Usage plan throttling or quotas exceeded

If throttling limits are hit, API Gateway may also return 403-like responses. Check CloudWatch logs to confirm.

After fixing the configuration

Give API Gateway 1–2 minutes for the changes to propagate before testing again:

https://<api-id>.execute-api.<region>.amazonaws.com/dev/test-resource

With the API key properly attached to the usage plan and the usage plan properly mapped to the API stage, the 403 "invalid API key" error will be resolved.

References

1. Usage Plans & API Keys https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-api-usage-plans.html
2. API Key Sources & Usage https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-api-key-source.html