Below is a practical, step-by-step Google Cloud API Gateway setup using a dummy backend on Cloud Run (hello service), then testing via curl. This follows Google’s official “API Gateway + Cloud Run” flow. (Google Cloud Documentation)

---

0) Prereqs

• A Google Cloud project + billing enabled
• Google Cloud SDK (gcloud) installed and logged in

Set variables (edit these 4 lines):

export PROJECT_ID="YOUR_PROJECT_ID"
export REGION="us-central1"
export API_ID="demo-api"
export GATEWAY_ID="demo-gw"
gcloud config set project "$PROJECT_ID"
Code language: JavaScript (javascript)

---

1) Enable required APIs

gcloud services enable \
  apigateway.googleapis.com \
  cloudbuild.googleapis.com \
  run.googleapis.com
Code language: CSS (css)

(API Gateway requires its service enabled; Cloud Run/Cloud Build are used for the dummy backend.) (Google Cloud Documentation)

---

2) Deploy a dummy backend on Cloud Run

Deploy a public “hello” container:

gcloud run deploy hello-backend \
  --image gcr.io/cloudrun/hello \
  --region "$REGION" \
  --allow-unauthenticated
Code language: JavaScript (javascript)

Get the Cloud Run URL:

export BACKEND_URL="$(gcloud run services describe hello-backend --region "$REGION" --format='value(status.url)')"
echo "$BACKEND_URL"
Code language: PHP (php)

Quick test the backend directly:

curl -i "$BACKEND_URL"
Code language: JavaScript (javascript)

---

3) Create an OpenAPI spec for API Gateway

Create a file openapi.yaml (Swagger/OpenAPI 2.0) like this:

swagger: "2.0"
info:
  title: "Demo API Gateway"
  description: "API Gateway -> Cloud Run dummy backend"
  version: "1.0.0"

schemes:
  - https

produces:
  - application/json

paths:
  /hello:
    get:
      operationId: hello
      x-google-backend:
        address: BACKEND_URL_REPLACE_ME
      responses:
        "200":
          description: OK
Code language: PHP (php)

Replace BACKEND_URL_REPLACE_ME with your Cloud Run URL:

sed -i.bak "s|BACKEND_URL_REPLACE_ME|$BACKEND_URL|g" openapi.yaml
Code language: JavaScript (javascript)

Why this works: API Gateway reads x-google-backend to know where to route requests. (Google Cloud Documentation)

---

4) Create an API config (uploads your OpenAPI to API Gateway)

export API_CONFIG_ID="demo-config-v1"

gcloud api-gateway api-configs create "$API_CONFIG_ID" \
  --api="$API_ID" \
  --openapi-spec=openapi.yaml \
  --project="$PROJECT_ID"
Code language: JavaScript (javascript)

Creating an API config is the “upload the definition” step. (Google Cloud Documentation)

---

5) Create a Gateway and deploy the config

gcloud api-gateway gateways create "$GATEWAY_ID" \
  --api="$API_ID" \
  --api-config="$API_CONFIG_ID" \
  --location="$REGION" \
  --project="$PROJECT_ID"
Code language: JavaScript (javascript)

This deploys the API config to a gateway. (Google Cloud Documentation)

---

6) Get the Gateway URL and test

Fetch the gateway’s default hostname:

export GATEWAY_HOST="$(gcloud api-gateway gateways describe "$GATEWAY_ID" --location "$REGION" --format='value(defaultHostname)')"
echo "$GATEWAY_HOST"
Code language: PHP (php)

Call your API through API Gateway:

curl -i "https://${GATEWAY_HOST}/hello"
Code language: JavaScript (javascript)

You should see a response coming from the Cloud Run hello backend (but accessed via the gateway).

---

Optional: Require an API Key (simple protection)

API Gateway can enforce API keys using security definitions. (Google Cloud Documentation)

A) Update openapi.yaml to require API key

Add these blocks:

securityDefinitions:
  api_key:
    type: "apiKey"
    name: "key"
    in: "query"

security:
  - api_key: []
Code language: JavaScript (javascript)

(Keep your /hello path the same.)

B) Create a NEW config and deploy it

export API_CONFIG_ID="demo-config-v2"

gcloud api-gateway api-configs create "$API_CONFIG_ID" \
  --api="$API_ID" \
  --openapi-spec=openapi.yaml

gcloud api-gateway gateways update "$GATEWAY_ID" \
  --location "$REGION" \
  --api="$API_ID" \
  --api-config="$API_CONFIG_ID"
Code language: JavaScript (javascript)

C) Create an API key in Google Cloud Console and test

Call without key (should fail), then with key:

curl -i "https://${GATEWAY_HOST}/hello?key=YOUR_API_KEY"
Code language: JavaScript (javascript)

---

Cleanup (avoid charges)

gcloud api-gateway gateways delete "$GATEWAY_ID" --location "$REGION" -q
gcloud api-gateway api-configs delete demo-config-v1 --api "$API_ID" -q || true
gcloud api-gateway api-configs delete demo-config-v2 --api "$API_ID" -q || true
gcloud api-gateway apis delete "$API_ID" -q
gcloud run services delete hello-backend --region "$REGION" -q
Code language: JavaScript (javascript)

---