[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M698YYV8SM3EKCDTFF6J6QN9":3,"skill-same:01M698YYV8SM3EKCDTFF6J6QN9":111},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":6,"ownerHtmlUrl":65,"ownerBlogUrl":66,"ownerDescription":67,"updatedAt":68,"install":69,"resources":82},"01M698YYV8SM3EKCDTFF6J6QN9","api-gateway-backend-security-and-rate-limiting",null,"Secures and rate limits backend services behind Google Cloud API Gateway across OpenAPI 2.0 and OpenAPI 3.0.x API configurations, including MCP-enabled gateways. Use when configuring API key or JWT authentication, locking down Cloud Run or Cloud Run functions backends with a gateway service account, reading authenticated claims from X-Apigateway-Api-Userinfo, setting per-project request quotas, or diagnosing HTTP 429 and HTTP 500 Service Control Quota errors. Do not use for Apigee, GKE Gateway API, Cloud Load Balancing custom domain setup, or LLM model routing.","google\u002Fskills","google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","01M698VYEFDM0VJBZDYYJ2T83S","Google","01M698WR0H76ENHE587T9EJT89",24122,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fapi-gateway-backend-security-and-rate-limiting\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,9],"api gateway backend security and rate limiting","rate","security","api gateway","gateway","api","backend security","backend","rate limiting","model","when","errors","Custom Domain","project","across","backend services","MCP","x api","authentication","google cloud","2026-11-10 10:12:30",false,"---\nname: api-gateway-backend-security-and-rate-limiting\nmetadata:\n  version: \"1.0.1\"\n  category: Security\ndescription: >-\n  Secures and rate limits backend services behind Google Cloud API Gateway\n  across OpenAPI 2.0 and OpenAPI 3.0.x API configurations, including MCP-enabled\n  gateways. Use when configuring API key or JWT authentication, locking down\n  Cloud Run or Cloud Run functions backends with a gateway service account,\n  reading authenticated claims from X-Apigateway-Api-Userinfo, setting per-project\n  request quotas, or diagnosing HTTP 429 and HTTP 500 Service Control Quota\n  errors. Do not use for Apigee, GKE Gateway API, Cloud Load Balancing custom\n  domain setup, or LLM model routing.\n---\n\n# API Gateway Backend Security and Rate Limiting\n\nThis skill configures client authentication, gateway-to-backend authentication, and per-project rate limits (quotas) for Google Cloud API Gateway across OpenAPI 2.0 (`swagger: \"2.0\"`) and OpenAPI 3.0.x (`openapi: 3.0.4`), including gateways with Model Context Protocol (MCP) enabled (Public Preview).\n\n## Attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you\nMUST read [Usage Attribution](references\u002Fattribution.md). For commands executed\ndirectly in the terminal (never in generated scripts, Terraform, or user code),\nprefix `gcloud` with\n`CLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:api-gateway-backend-security-and-rate-limiting)\"`\nand append `agent-skills\u002F1.0 (skill:api-gateway-backend-security-and-rate-limiting)` to `User-Agent` headers.\n\n## Prerequisites\n\n1. **Install the Google Cloud CLI and Python 3.10+ YAML parser:**\n   - Install or update the [Google Cloud SDK](https:\u002F\u002Fdocs.cloud.google.com\u002Fsdk\u002Fdocs\u002Finstall-sdk.md.txt).\n   - Install `PyYAML` for the quota metric validation script:\n     ```bash\n     pip install \"PyYAML>=6.0,\u003C7.0\"\n     ```\n2. **Authenticate your environment:**\n   - Local CLI session: `gcloud auth login`\n   - Application Default Credentials (SDKs): `gcloud auth application-default login`\n   - Service account key file (if required by CI): set `GOOGLE_APPLICATION_CREDENTIALS={key_file_path}`\n3. **Select or create a project, verify billing, and pick a supported gateway location:**\n   - Select an existing project (`gcloud config set project {project_id}`) or create one (`gcloud projects create {project_id}` as an escape hatch).\n   - Verify that an active billing account is linked to `{project_id}` (required even when staying within the [API Gateway pricing free tier](https:\u002F\u002Fcloud.google.com\u002Fapi-gateway\u002Fpricing)).\n   - Use `us-central1` as the default `--location` for API Gateway commands. For the other supported regions, see [API Gateway deployment model](https:\u002F\u002Fdocs.cloud.google.com\u002Fapi-gateway\u002Fdocs\u002Fdeployment-model.md.txt).\n4. **Enable required Google Cloud APIs:**\n   ```bash\n   gcloud services enable \\\n     apigateway.googleapis.com \\\n     servicemanagement.googleapis.com \\\n     servicecontrol.googleapis.com \\\n     iam.googleapis.com \\\n     apikeys.googleapis.com \\\n     --project={project_id}\n   ```\n   API Gateway does not need the Cloud Run API. If the backend runs on Cloud Run, that API is already enabled in the backend's project.\n5. **Verify required IAM roles:**\n   - To manage API Gateway resources and enable services: `roles\u002Fapigateway.admin` and `roles\u002Fserviceusage.serviceUsageAdmin`\n   - To create the gateway service account and attach it to an API config: `roles\u002Fiam.serviceAccountAdmin` and `roles\u002Fiam.serviceAccountUser`\n   - To manage API keys in consumer projects: `roles\u002Fserviceusage.apiKeysAdmin`\n   - For the gateway service account to invoke the backend: `roles\u002Frun.invoker` (Cloud Run or 2nd gen functions) or `roles\u002Fcloudfunctions.invoker` (1st gen functions)\n\n## Decision Matrix: Client Authentication, Backend Security, and Quotas\n\nSelect the layer that matches the security requirement:\n\n| Goal | Mechanism to Configure | Key Constraint | Detailed Reference |\n| --- | --- | --- | --- |\n| Identify the calling consumer project for quotas and billing | API key (`x-api-key` header convention; `key` query parameter escape hatch) | NEVER rely on an API key alone to authenticate end-user identity. **Rationale:** API keys identify a Google Cloud project rather than a user, and clients can extract them. | [Client Authentication](references\u002Fclient-authentication.md) |\n| Authenticate end users or calling services | JWT (`oauth2` scheme with `x-google-issuer` \u002F `x-google-jwks_uri` in OAS 2.0, or `x-google-auth` in OAS 3.x) | Operation-level `security` overrides root `security`. Include `api_key: []` and the JWT scheme in the same security requirement object when an endpoint needs both user identity and quotas. | [Client Authentication](references\u002Fclient-authentication.md) |\n| Block direct calls to the backend service | Dedicated gateway service account (`--backend-auth-service-account`) + `roles\u002Frun.invoker` + backend `--no-allow-unauthenticated` | Roll out the gateway config with `--backend-auth-service-account` BEFORE setting `--no-allow-unauthenticated` on a live backend to avoid `403` downtime. | [Backend Security](references\u002Fbackend-security.md) |\n| Rate limit requests per consumer project (`1\u002Fmin\u002F{project}`) | `x-google-management` (OAS 2.0) or `x-google-api-management` (OAS 3.x) + `x-google-quota` | NEVER rename or remove a quota metric when creating a new API config while any gateway of the API runs an older config referencing that metric. **Rationale:** Creating the config immediately overwrites API-wide quotas and causes `HTTP 500 Failed to call Service Control Quota` on older gateways. | [Quotas and Rate Limiting](references\u002Fquotas-and-rate-limiting.md) |\n| Secure MCP `tools\u002Flist` and `tools\u002Fcall` on `\u002Fmcp` (Public Preview) | `x-google-api-management.mcp.tools-list.security` (exactly one JWT or API key scheme) + operation `security` and `x-google-mcp-tool: false` | `x-google-mcp-tool: false` hides an operation from MCP only; the underlying REST route remains live unless secured or removed. | [MCP Traffic Security](references\u002Fmcp-traffic-security.md) |\n\n## Execution Workflow and Validation Loop\n\nFollow this zero-downtime sequence when authoring or updating an API Gateway security or quota configuration:\n\n1. **Create the gateway service account and grant backend invoker permissions:**\n   - Follow Steps 1–3 of [Backend Security](references\u002Fbackend-security.md) to create `{gateway_sa_name}` and request human approval before granting `roles\u002Frun.invoker` on `{backend_service}`.\n   - Update backend handler code to decode verified user claims from `X-Apigateway-Api-Userinfo` (`base64url`-encoded JSON) instead of `Authorization`.\n2. **Author the OpenAPI authentication and quota definitions:**\n   - Use the OpenAPI 2.0 or OpenAPI 3.0.x templates and provider tables in [Client Authentication](references\u002Fclient-authentication.md) and [Quotas and Rate Limiting](references\u002Fquotas-and-rate-limiting.md).\n   - If the specification enables MCP (`x-google-api-management.mcp`), configure exactly one JWT or API key scheme on `tools-list` (also list a JWT scheme in the root `security` list), and review operation opt-outs using [MCP Traffic Security](references\u002Fmcp-traffic-security.md).\n3. **Run the quota metric validation loop BEFORE running `api-configs create`:**\n   - If neither the active specs nor `{candidate_openapi_spec}` define quota metrics (`x-google-management.metrics` or `x-google-api-management.metrics`), skip this step.\n   - Request human approval before creating an API config that defines or modifies quotas, because `api-configs create` immediately replaces quota definitions across all gateways of the API.\n   - By default, run `scripts\u002Fcheck_quota_metrics.py` against all active gateways deployed for `{api_id}` in `{project_id}`:\n     ```bash\n     python3 scripts\u002Fcheck_quota_metrics.py \\\n       --spec={candidate_openapi_spec} \\\n       --project={project_id} \\\n       --api={api_id}\n     ```\n   - Escape hatch for offline environments without `gcloud` access (pass `--baseline-spec` for every config currently served by a gateway of the API):\n     ```bash\n     python3 scripts\u002Fcheck_quota_metrics.py \\\n       --spec={candidate_openapi_spec} \\\n       --baseline-spec={previous_openapi_spec} \\\n       --dry-run\n     ```\n   - If `scripts\u002Fcheck_quota_metrics.py` exits with code `1` (`status: \"FAIL\"`), add the missing metrics and limits back to `{candidate_openapi_spec}`, move each `x-google-quota` listed in `ignored_quota_extensions` into the operations it applies to, and re-run the script until it exits with code `0` (`status: \"PASS\"`). If the user wants to remove a limit on purpose, confirm the removal with the user, because it removes that limit from every gateway of the API. If `skipped_configs` is not empty, tell the user that the script did not inspect those API configs (for example, gRPC configs), and check their quota metrics and limits manually. If it exits with code `2`, fix the problem printed to stderr: the CLI arguments, `gcloud` authentication, or an API config that the script cannot inspect.\n4. **Create the API config, update the gateway, enable the managed service, and lock down the backend:**\n   - Follow Steps 4–5 of [Backend Security](references\u002Fbackend-security.md) to run `gcloud api-gateway api-configs create` and `gcloud api-gateway gateways update` (request human approval before updating a production gateway), enable the API's `managedService` in consumer projects ([Client Authentication](references\u002Fclient-authentication.md)), and then restrict `{backend_service}` with `--no-allow-unauthenticated`.\n   - Verify that direct calls to the backend `*.run.app` URL return `403`, unauthenticated calls to the gateway `defaultHostname` return `401`, and authenticated calls return `200`.\n\n## Pre-Deployment Checklist\n\n- [ ] Dedicated `{gateway_sa_name}` is granted `roles\u002Frun.invoker` (or `roles\u002Fcloudfunctions.invoker`), and `--no-allow-unauthenticated` is applied after the gateway config is active.\n- [ ] Backend code decodes `X-Apigateway-Api-Userinfo` for user claims.\n- [ ] Security enforcement does not depend solely on a load balancer or Google Cloud Armor in front of the gateway, because the gateway's `defaultHostname` (`*.gateway.dev`) cannot be disabled.\n- [ ] Every quota-enforced operation requires an API key (`api_key: []`), and the API's `managedService` is enabled and allowed on the API key in each consumer project.\n- [ ] `python3 scripts\u002Fcheck_quota_metrics.py` returns `status: \"PASS\"` (exit code `0`) against active gateway configs or all baseline specs before `api-configs create`.\n- [ ] If MCP is enabled, `x-google-api-management.mcp.tools-list.security` names exactly one JWT or API key scheme (a JWT scheme is also in the root `security` list), and administrative endpoints are secured on REST in addition to `x-google-mcp-tool: false`.\n\n## Resource Cleanup\n\nTo avoid ongoing charges when tearing down a test or staging environment, request human approval and delete the gateway, all API configs, the API, and the service account in dependency order:\n\n```bash\ngcloud api-gateway gateways delete {gateway_id} --location={region} --project={project_id}\ngcloud api-gateway api-configs delete {config_id} --api={api_id} --project={project_id}\ngcloud api-gateway apis delete {api_id} --project={project_id}\ngcloud iam service-accounts delete {gateway_sa_name}@{project_id}.iam.gserviceaccount.com --project={project_id}\n```\n","# API Gateway Backend Security and Rate Limiting\n\nThis skill configures client authentication, gateway-to-backend authentication, and per-project rate limits (quotas) for Google Cloud API Gateway across OpenAPI 2.0 (`swagger: \"2.0\"`) and OpenAPI 3.0.x (`openapi: 3.0.4`), including gateways with Model Context Protocol (MCP) enabled (Public Preview).\n\n## Attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you\nMUST read [Usage Attribution](references\u002Fattribution.md). For commands executed\ndirectly in the terminal (never in generated scripts, Terraform, or user code),\nprefix `gcloud` with\n`CLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:api-gateway-backend-security-and-rate-limiting)\"`\nand append `agent-skills\u002F1.0 (skill:api-gateway-backend-security-and-rate-limiting)` to `User-Agent` headers.\n\n## Prerequisites\n\n1. **Install the Google Cloud CLI and Python 3.10+ YAML parser:**\n   - Install or update the [Google Cloud SDK](https:\u002F\u002Fdocs.cloud.google.com\u002Fsdk\u002Fdocs\u002Finstall-sdk.md.txt).\n   - Install `PyYAML` for the quota metric validation script:\n     ```bash\n     pip install \"PyYAML>=6.0,\u003C7.0\"\n     ```\n2. **Authenticate your environment:**\n   - Local CLI session: `gcloud auth login`\n   - Application Default Credentials (SDKs): `gcloud auth application-default login`\n   - Service account key file (if required by CI): set `GOOGLE_APPLICATION_CREDENTIALS={key_file_path}`\n3. **Select or create a project, verify billing, and pick a supported gateway location:**\n   - Select an existing project (`gcloud config set project {project_id}`) or create one (`gcloud projects create {project_id}` as an escape hatch).\n   - Verify that an active billing account is linked to `{project_id}` (required even when staying within the [API Gateway pricing free tier](https:\u002F\u002Fcloud.google.com\u002Fapi-gateway\u002Fpricing)).\n   - Use `us-central1` as the default `--location` for API Gateway commands. For the other supported regions, see [API Gateway deployment model](https:\u002F\u002Fdocs.cloud.google.com\u002Fapi-gateway\u002Fdocs\u002Fdeployment-model.md.txt).\n4. **Enable required Google Cloud APIs:**\n   ```bash\n   gcloud services enable \\\n     apigateway.googleapis.com \\\n     servicemanagement.googleapis.com \\\n     servicecontrol.googleapis.com \\\n     iam.googleapis.com \\\n     apikeys.googleapis.com \\\n     --project={project_id}\n   ```\n   API Gateway does not need the Cloud Run API. If the backend runs on Cloud Run, that API is already enabled in the backend's project.\n5. **Verify required IAM roles:**\n   - To manage API Gateway resources and enable services: `roles\u002Fapigateway.admin` and `roles\u002Fserviceusage.serviceUsageAdmin`\n   - To create the gateway service account and attach it to an API config: `roles\u002Fiam.serviceAccountAdmin` and `roles\u002Fiam.serviceAccountUser`\n   - To manage API keys in consumer projects: `roles\u002Fserviceusage.apiKeysAdmin`\n   - For the gateway service account to invoke the backend: `roles\u002Frun.invoker` (Cloud Run or 2nd gen functions) or `roles\u002Fcloudfunctions.invoker` (1st gen functions)\n\n## Decision Matrix: Client Authentication, Backend Security, and Quotas\n\nSelect the layer that matches the security requirement:\n\n| Goal | Mechanism to Configure | Key Constraint | Detailed Reference |\n| --- | --- | --- | --- |\n| Identify the calling consumer project for quotas and billing | API key (`x-api-key` header convention; `key` query parameter escape hatch) | NEVER rely on an API key alone to authenticate end-user identity. **Rationale:** API keys identify a Google Cloud project rather than a user, and clients can extract them. | [Client Authentication](references\u002Fclient-authentication.md) |\n| Authenticate end users or calling services | JWT (`oauth2` scheme with `x-google-issuer` \u002F `x-google-jwks_uri` in OAS 2.0, or `x-google-auth` in OAS 3.x) | Operation-level `security` overrides root `security`. Include `api_key: []` and the JWT scheme in the same security requirement object when an endpoint needs both user identity and quotas. | [Client Authentication](references\u002Fclient-authentication.md) |\n| Block direct calls to the backend service | Dedicated gateway service account (`--backend-auth-service-account`) + `roles\u002Frun.invoker` + backend `--no-allow-unauthenticated` | Roll out the gateway config with `--backend-auth-service-account` BEFORE setting `--no-allow-unauthenticated` on a live backend to avoid `403` downtime. | [Backend Security](references\u002Fbackend-security.md) |\n| Rate limit requests per consumer project (`1\u002Fmin\u002F{project}`) | `x-google-management` (OAS 2.0) or `x-google-api-management` (OAS 3.x) + `x-google-quota` | NEVER rename or remove a quota metric when creating a new API config while any gateway of the API runs an older config referencing that metric. **Rationale:** Creating the config immediately overwrites API-wide quotas and causes `HTTP 500 Failed to call Service Control Quota` on older gateways. | [Quotas and Rate Limiting](references\u002Fquotas-and-rate-limiting.md) |\n| Secure MCP `tools\u002Flist` and `tools\u002Fcall` on `\u002Fmcp` (Public Preview) | `x-google-api-management.mcp.tools-list.security` (exactly one JWT or API key scheme) + operation `security` and `x-google-mcp-tool: false` | `x-google-mcp-tool: false` hides an operation from MCP only; the underlying REST route remains live unless secured or removed. | [MCP Traffic Security](references\u002Fmcp-traffic-security.md) |\n\n## Execution Workflow and Validation Loop\n\nFollow this zero-downtime sequence when authoring or updating an API Gateway security or quota configuration:\n\n1. **Create the gateway service account and grant backend invoker permissions:**\n   - Follow Steps 1–3 of [Backend Security](references\u002Fbackend-security.md) to create `{gateway_sa_name}` and request human approval before granting `roles\u002Frun.invoker` on `{backend_service}`.\n   - Update backend handler code to decode verified user claims from `X-Apigateway-Api-Userinfo` (`base64url`-encoded JSON) instead of `Authorization`.\n2. **Author the OpenAPI authentication and quota definitions:**\n   - Use the OpenAPI 2.0 or OpenAPI 3.0.x templates and provider tables in [Client Authentication](references\u002Fclient-authentication.md) and [Quotas and Rate Limiting](references\u002Fquotas-and-rate-limiting.md).\n   - If the specification enables MCP (`x-google-api-management.mcp`), configure exactly one JWT or API key scheme on `tools-list` (also list a JWT scheme in the root `security` list), and review operation opt-outs using [MCP Traffic Security](references\u002Fmcp-traffic-security.md).\n3. **Run the quota metric validation loop BEFORE running `api-configs create`:**\n   - If neither the active specs nor `{candidate_openapi_spec}` define quota metrics (`x-google-management.metrics` or `x-google-api-management.metrics`), skip this step.\n   - Request human approval before creating an API config that defines or modifies quotas, because `api-configs create` immediately replaces quota definitions across all gateways of the API.\n   - By default, run `scripts\u002Fcheck_quota_metrics.py` against all active gateways deployed for `{api_id}` in `{project_id}`:\n     ```bash\n     python3 scripts\u002Fcheck_quota_metrics.py \\\n       --spec={candidate_openapi_spec} \\\n       --project={project_id} \\\n       --api={api_id}\n     ```\n   - Escape hatch for offline environments without `gcloud` access (pass `--baseline-spec` for every config currently served by a gateway of the API):\n     ```bash\n     python3 scripts\u002Fcheck_quota_metrics.py \\\n       --spec={candidate_openapi_spec} \\\n       --baseline-spec={previous_openapi_spec} \\\n       --dry-run\n     ```\n   - If `scripts\u002Fcheck_quota_metrics.py` exits with code `1` (`status: \"FAIL\"`), add the missing metrics and limits back to `{candidate_openapi_spec}`, move each `x-google-quota` listed in `ignored_quota_extensions` into the operations it applies to, and re-run the script until it exits with code `0` (`status: \"PASS\"`). If the user wants to remove a limit on purpose, confirm the removal with the user, because it removes that limit from every gateway of the API. If `skipped_configs` is not empty, tell the user that the script did not inspect those API configs (for example, gRPC configs), and check their quota metrics and limits manually. If it exits with code `2`, fix the problem printed to stderr: the CLI arguments, `gcloud` authentication, or an API config that the script cannot inspect.\n4. **Create the API config, update the gateway, enable the managed service, and lock down the backend:**\n   - Follow Steps 4–5 of [Backend Security](references\u002Fbackend-security.md) to run `gcloud api-gateway api-configs create` and `gcloud api-gateway gateways update` (request human approval before updating a production gateway), enable the API's `managedService` in consumer projects ([Client Authentication](references\u002Fclient-authentication.md)), and then restrict `{backend_service}` with `--no-allow-unauthenticated`.\n   - Verify that direct calls to the backend `*.run.app` URL return `403`, unauthenticated calls to the gateway `defaultHostname` return `401`, and authenticated calls return `200`.\n\n## Pre-Deployment Checklist\n\n- [ ] Dedicated `{gateway_sa_name}` is granted `roles\u002Frun.invoker` (or `roles\u002Fcloudfunctions.invoker`), and `--no-allow-unauthenticated` is applied after the gateway config is active.\n- [ ] Backend code decodes `X-Apigateway-Api-Userinfo` for user claims.\n- [ ] Security enforcement does not depend solely on a load balancer or Google Cloud Armor in front of the gateway, because the gateway's `defaultHostname` (`*.gateway.dev`) cannot be disabled.\n- [ ] Every quota-enforced operation requires an API key (`api_key: []`), and the API's `managedService` is enabled and allowed on the API key in each consumer project.\n- [ ] `python3 scripts\u002Fcheck_quota_metrics.py` returns `status: \"PASS\"` (exit code `0`) against active gateway configs or all baseline specs before `api-configs create`.\n- [ ] If MCP is enabled, `x-google-api-management.mcp.tools-list.security` names exactly one JWT or API key scheme (a JWT scheme is also in the root `security` list), and administrative endpoints are secured on REST in addition to `x-google-mcp-tool: false`.\n\n## Resource Cleanup\n\nTo avoid ongoing charges when tearing down a test or staging environment, request human approval and delete the gateway, all API configs, the API, and the service account in dependency order:\n\n```bash\ngcloud api-gateway gateways delete {gateway_id} --location={region} --project={project_id}\ngcloud api-gateway api-configs delete {config_id} --api={api_id} --project={project_id}\ngcloud api-gateway apis delete {api_id} --project={project_id}\ngcloud iam service-accounts delete {gateway_sa_name}@{project_id}.iam.gserviceaccount.com --project={project_id}\n```\n",{"name":5,"metadata":57,"description":7},{"version":58,"category":59},"1.0.1","Security","main","bb9b3f464aae37af360d079c1d863524955b0363","skills\u002Fcloud\u002Fapi-gateway-backend-security-and-rate-limiting",2005,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills","https:\u002F\u002Fgithub.com\u002Fgoogle","https:\u002F\u002Fopensource.google\u002F","Google ❤️ Open Source","2026-11-14 01:51:35",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add google\u002Fskills --skill api-gateway-backend-security-and-rate-limiting",{"tool":75,"command":76},"bunx","bunx skills add google\u002Fskills --skill api-gateway-backend-security-and-rate-limiting",{"tool":78,"command":79},"pnpm","pnpm dlx skills add google\u002Fskills --skill api-gateway-backend-security-and-rate-limiting","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fapi-gateway-backend-security-and-rate-limiting\u002FSKILL.md",true,[83,89,93,97,101,105],{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"references\u002Fattribution.md","REFERENCE","参考文档",1986,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fapi-gateway-backend-security-and-rate-limiting\u002Freferences\u002Fattribution.md",{"path":90,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fbackend-security.md",8016,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fapi-gateway-backend-security-and-rate-limiting\u002Freferences\u002Fbackend-security.md",{"path":94,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fclient-authentication.md",9267,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fapi-gateway-backend-security-and-rate-limiting\u002Freferences\u002Fclient-authentication.md",{"path":98,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fmcp-traffic-security.md",9690,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fapi-gateway-backend-security-and-rate-limiting\u002Freferences\u002Fmcp-traffic-security.md",{"path":102,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fquotas-and-rate-limiting.md",7704,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fapi-gateway-backend-security-and-rate-limiting\u002Freferences\u002Fquotas-and-rate-limiting.md",{"path":106,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":109,"sourceHtmlUrl":110},"scripts\u002Fcheck_quota_metrics.py","SCRIPT","脚本",16093,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fapi-gateway-backend-security-and-rate-limiting\u002Fscripts\u002Fcheck_quota_metrics.py",[112,144,168,194,221,245],{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":122,"publishedAt":52},"01M6998S2EZKD3GEJ7F943RZTE","sign-in-with-google-web","Implement, configure, and secure Sign In With Google (SiwG) using Google Identity Services (GIS \u002F `https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fclient`) across web architectures. Use when creating Google sign-in buttons, implementing Google One Tap with FedCM, integrating GIS in React\u002FNext.js\u002FAngular\u002FHTML, verifying ID tokens on backend runtimes (Python\u002FNode.js\u002FGo\u002FJava), enforcing Google Workspace domain restrictions (`hd`), securing client-side ID tokens via WebCrypto nonces or encrypted IndexedDB, embedding in cross-origin iframes via the Intermediate Iframe API (`https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fintermediate`), configuring Content Security Policy (CSP), COOP, and Permissions Policy (`identity-credentials-get`) headers, or handling sign-out and revocation. Don't use for legacy Google Sign-In (`gapi.auth2`), Google Cloud IAM service accounts, or Android\u002FiOS native Credential Manager.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fsign-in-with-google-web\u002FSKILL.md",[118,121],{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[9,123,124,125,126,127,128,34,129,51,130,131,132,133,134,135,136,137,138,139,140,141,142,143],"sign in with google web","sign","with","web","android","go","google workspace","implement","policy","python","implementing","react","iam","permissions","buttons","secure","manager","identity","architectures","domain","runtimes",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":153,"publishedAt":52},"01M6998PHPDCAD684VW5WRG83D","dpop-adoption","Implement and debug OAuth 2.0 DPoP (RFC 9449) refresh token sender-constraining for WebCrypto, Node.js ES6, and browser runtimes integrating with Google's OAuth platform. Use when configuring non-extractable asymmetric key pairs (P-256), generating DPoP Proof JWTs for authorization code exchange and token refresh, or handling 400 use_dpop_nonce challenge retry loops at oauth2.googleapis.com\u002Ftoken. Don't use for unconstrained OAuth 2.0 flows (where refresh tokens are not bound to a client key pair), or for Google Cloud IAM \u002F service account authentication.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fdpop-adoption\u002FSKILL.md",[150,151,152],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},[154,155,9,51,156,157,50,158,159,160,135,161,162,163,164,165,166,140,143,167,42],"dpop adoption","adoption","es6","retry","flows","challenge","code","browser","loops","at","node","token","pair","platform",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":180,"publishedAt":52},"01M6998M72TC73EEAQH4XC7EXW","retrieving-developer-knowledge","Searches, retrieves, and synthesizes official Google developer documentation across Google Cloud, AI\u002FGemini, Android, Chrome, Web, Flutter, Go, Firebase, and other Google developer platforms. Integrates with the Developer Knowledge MCP server (search_documents, get_documents, answer_query) or the Developer Knowledge REST API fallback. Use when searching for gcloud CLI commands, API syntax, IAM permissions, official documentation, architectural comparisons, or product choice overviews. Don't use for local filesystem lookups or non-Google documentation.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fretrieving-developer-knowledge\u002FSKILL.md",[174,175,178,179],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":176,"categoryName":177,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},[181,182,183,48,51,184,185,186,187,188,189,190,191,42,192,37,46,135,193,136],"retrieving developer knowledge","knowledge","developer","mcp server","official","developer documentation","get","search","local","choice","documents","query","documentation",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":200,"publishedAt":52},"01M6998J2CZEXS9BES9S3WWFKC","migrate-to-rust","Clones, analyzes, plans, and migrates legacy codebases (C++, Fortran, Java, Python, C, Shell) from a GitHub URL or local directory to a modern, high-performance, deterministic, 100% Safe Rust architecture, tracking live telemetry across every task bucket, test failure\u002Ffix cycle, and Profile-Guided Optimization (PGO) stage, and producing a first-person AI storytelling report and interactive HTML infographic. Use when migrating a GitHub repository or local codebase to Rust, porting legacy C++, Fortran, Python, or Java workloads to memory-safe Rust, designing Struct-of-Arrays (SoA) or SIMD Rust architectures, or optimizing Rust ports with LLVM PGO. Don't use for unrelated non-Rust refactoring or single-line syntax questions.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fmigrate-to-rust\u002FSKILL.md",[],[201,202,203,204,205,206,207,208,132,209,210,211,212,213,214,189,215,216,217,42,218,219,46,220],"migrate to rust","rust","migrate","github","memory","performance","directory","safe","ports","llvm","soa","cycle","porting","fix","arrays","infographic","high-performance","URL","architecture","unrelated",{"skillNo":222,"name":223,"nameZh":6,"description":224,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":225,"categories":226,"keywords":230,"publishedAt":52},"01M6998GCC3K29WZ82KXMB9E02","finding-google-skills","Google platform decision and setup guidance, loaded on demand from Google's skill catalog. Use when a developer is choosing or setting up part of their stack, such as where to run a service, a database, storage, messaging, authentication, analytics, ads, or AI model serving, and a Google product is a reasonable candidate - whether or not a vendor is named - or when a request names a Google product or API. Brings in the matching Google skill so the answer can weigh Google options, their trade-offs, and when they are not the right fit. Skip when the stack is already settled on another provider and no Google product is named, or the task involves no platform choice.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Ffinding-google-skills\u002FSKILL.md",[227,228,229],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},[9,231,232,233,234,167,41,235,236,237,238,50,239,240,241,190,242,243,42,244,37],"finding google skills","storage","as","messaging","trade-offs","provider","answer","fit","catalog","up","decision","use","database","candidate",{"skillNo":246,"name":247,"nameZh":6,"description":248,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":249,"categories":250,"keywords":253,"publishedAt":52},"01M6998DWNHTH0BS6W1CY8ZXMP","workload-manager-basics","Use this skill to manage Google Cloud Workload Manager evaluations, rules, scanned resources, and validation results by using public client libraries and the REST API. Use when you need to inspect workload best-practice rules, create and run evaluations for Google Cloud general best practices, SAP, SQL Server, or custom organizational rules, review violations, export results to BigQuery, or automate Workload Manager through client libraries because no service-specific public CLI or MCP server is available. Don't use for general Google Compute Engine instance management, VPC configuration, or standard IAM auditing.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fworkload-manager-basics\u002FSKILL.md",[251,252],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[254,255,139,256,9,48,257,51,184,258,259,260,261,42,262,37,135,263,264,265,266],"workload manager basics","workload","basics","cli","review","vpc","resources","inspect","you","create","libraries","server","run"]