A publicly accessible single-page web app (client-side) calls a third-party HTTP API that requires an API key provided in an HTTP header. The company’s API key must not be exposed to end users. Which cost-effective solution ensures the API key is kept secret?

The correct solution uses a public REST API with Amazon API Gateway and an HTTP integration. The single-page web app (client-side) can directly call this public API Gateway endpoint. API Gateway then acts as a proxy, forwarding the request to the third-party API. Crucially, API Gateway can be configured to add the company's API key to the HTTP header before sending the request to the third-party API. This keeps the API key secret from the end-user's browser, as it's never exposed client-side. Using a private REST API is incorrect because the client-side web app needs to access the API Gateway endpoint directly, which requires a public endpoint. While Lambda proxy integrations can also hide the API key, an HTTP integration is more cost-effective for this specific scenario as it avoids the additional compute cost of a Lambda function when simple header modification is sufficient.