AWS API Gateway: 403 forbidden with disabled API key; error from cloudfront
When you deploy an edge-optimized API, API Gateway sets up an Amazon CloudFront distribution and a DNS record to map the API domain name to the CloudFront distribution domain name. Requests for the API are then routed to API Gateway through the mapped CloudFront distribution.

Source: API Gateway documentation — Edge-optimized custom domain names.

To allow calls to a method of a resource in your API without API key, set its API Key Required setting to false: