Usage plan and throttling without API KEY

You can still configure throttling for your REST API Gateway without using API keys, but there are some important distinctions to understand.

API Gateway allows you to set throttling limits at different levels. When you don't use API keys, you can still implement throttling at the API or stage level, which applies to all traffic to that API or stage regardless of the source.

Throttling limits set the target point at which request throttling should start. These can be configured at the API or API method level. However, it's important to note that usage plans and their associated quotas are specifically designed to work with API keys, as they track and limit usage on a per-API-key basis.

Without API keys, you won't be able to:

• Track usage on a per-client basis
• Set different throttling limits for different clients
• Enforce quota limits (maximum number of requests within a time interval) for specific clients

If you need to implement basic throttling without API keys, you can configure the default throttling settings for your API stage. This will apply the same throttling limits to all incoming requests regardless of their source.

For more granular control over API access and usage, including client-specific quotas and throttling, you would need to implement API keys and usage plans, or consider using other AWS services like AWS WAF for additional request management capabilities.

Remember that usage plan throttling and quotas are applied on a best-effort basis and are not hard limits.
Sources
Usage plans and API keys for REST APIs in API Gateway - Amazon API Gateway
Create and configure API keys and usage plans with AWS CloudFormation - Amazon API Gateway

In addition to the AI answer, you can still use Usage plans, without distributing API Keys to the clients. The way to do that is using a Lambda authorizer. When you use a Lambda authorizer you can configure the API to get the API Key from the authorizer, and not only from the request. This way your Lambda function can validate the token, as well as return an API Key which corresponds with the user.