A city’s sanitation department is shipping a mobile app for bulky-item pickup. Developers considered giving every phone a direct Oracle Functions invoke URL and an API-signing key. Why should external clients call OCI API Gateway over HTTPS instead?
Select an answer to reveal the explanation.
Short Explanation
Handing every phone a raw Function URL is like publishing every clerk’s desk phone instead of one city hall switchboard. Clients call the gateway over HTTPS (including HTTP/2); the gateway invokes Functions or HTTP back ends. Auth tokens and usage-plan tokens belong on that gateway request—the anti-pattern is scattering invoke endpoints and signing keys to every mobile client.
Full Explanation
External clients—including a sanitation department’s mobile app—should call OCI API Gateway over HTTPS (including HTTP/2). The gateway terminates the client connection and then invokes Oracle Functions or HTTP back ends according to the deployment. Authentication credentials and usage-plan tokens belong on that gateway request so auth, CORS, validation, rate limits, and metering stay centralized. Scattering direct Functions invoke URLs and API-signing keys to every phone publishes many private desk lines instead of one city switchboard and weakens control.
The claim that Functions invoke endpoints only accept plain HTTP/1.0 and cannot terminate TLS is incorrect and invents a protocol limitation. The claim that API Gateway cannot invoke Functions is false—gateway-to-Functions is a primary pattern. Requiring Streaming private endpoints before any HTTPS client can reach a Function conflates an unrelated streaming attachment model with synchronous API access.
Exam caveat: the anti-pattern under test is giving every external client a raw invoke endpoint and signing key. Internal tooling might call Functions differently; external civic apps should front the gateway.
Operational check: point the mobile client only at the gateway HTTPS URL, confirm Functions are invoked by the gateway (not by embedded invoke URLs), and verify auth and usage-plan tokens are validated on the gateway request path.