Do I need API gateway quotas for partner APIs?

Not always, but often yes—if by “partner APIs” you mean APIs exposed to external partners or third parties.

When you do want quotas

Use API Gateway quotas when you need to:

• Limit usage by partner so one partner can’t consume all capacity
• Protect backend services from accidental or abusive overuse
• Enforce contractual limits like “10,000 requests/day per partner”
• Create pricing/tiers for different partners
• Prevent noisy-neighbor problems across multiple external consumers

When you might not need quotas

You may skip quotas if:

• The API is used by only a small number of trusted partners
• Usage is already controlled by authentication, rate limiting, or backend controls
• The API is internal or low-risk and you don’t need per-partner enforcement
• Your org manages limits elsewhere, such as in an identity layer, WAF, or backend service

Important distinction: quotas vs rate limits

• Rate limits = how much traffic in a short time window (e.g., 100 requests/second)
• Quotas = total allowed usage over a longer period (e.g., 1 million requests/month)

For partner APIs, it’s common to use both:

• Rate limit to protect systems in real time
• Quotas to enforce business agreements

Practical recommendation

If your partner API is externally consumed, start with:

1. Authentication/authorization
2. Per-partner rate limiting
3. Quotas if you have tiered plans or usage commitments

If you want, I can also help you decide whether to use API Gateway quotas specifically in AWS Apigee / Kong / Azure API Management / GCP API Gateway, since the answer can differ by platform.