A company uses API Gateway with the built-in API key validation. A new registration page calls CreateApiKey to provision an API key and returns it to the user. When a new user tries to call the API with that key, they get 403 Forbidden. Existing users are unaffected. What additional API call or update must the registration code perform so the new user can use the API?

The correct answer is createUsagePlanKey. While CreateApiKey generates an API key, it doesn't automatically associate it with a usage plan. API Gateway's built-in API key validation requires API keys to be linked to a usage plan that is deployed to the specific stage the API is being called. Without this link, the API Gateway rejects calls with a 403 Forbidden error, even if the key itself is valid. createUsagePlanKey establishes this crucial connection. createDeployment is incorrect because API key creation and association with usage plans are runtime operations and do not require API redeployment. updateAuthorizer is incorrect; authorizers handle authentication logic, not API key validation against usage plans. importApiKeys is used for bulk importing existing keys, not for linking newly created keys to usage plans.