A city’s sanitation department is shipping a mobile app for bulky-item pickup. Developers considered giving every phone a direct Oracle Functions invoke URL and an API-signing key. Why should external clients call OCI API Gateway over HTTPS instead?
Select an answer to reveal the explanation.
Short Explanation
Handing every phone a raw Function URL is like publishing every clerk’s desk phone instead of one city hall switchboard. Clients call the gateway over HTTPS (including HTTP/2); the gateway invokes Functions or HTTP back ends. Auth tokens and usage-plan tokens belong on that gateway request—the anti-pattern is scattering invoke endpoints and signing keys to every mobile client.
Full Explanation
OCI API Gateway is the HTTPS front door for API clients. Consumers call the gateway (HTTP/2 supported); the gateway then invokes Oracle Functions or HTTP back ends. Distributing Functions invoke endpoints and API-signing keys to every mobile client is the anti-pattern the service exists to avoid. Authentication tokens and usage-plan client tokens are presented on the gateway request, centralizing policy enforcement.