API Gateway

What an API Gateway Does

An API Gateway sits between clients and backend services, acting as the single entry point for all API traffic. It handles cross-cutting concerns — authentication, Rate LimitingA technique that restricts the number of requests a client can make to an API or server within a time window. Rate limiting protects against abuse, brute-force attacks, and resource exhaustion., SSL/TLSSecure Sockets Layer / Transport Layer Security. Cryptographic protocols that provide encrypted, authenticated communication over a network. SSL is deprecated; modern implementations use TLS 1.2 or TLS 1.3. termination, request routing, and response transformation — so individual backend services do not need to implement each concern independently.

Core Capabilities

Request routing maps incoming paths and methods to specific MicroservicesAn architectural style that structures an application as a collection of loosely coupled, independently deployable services, each responsible for a specific business function and communicating over APIs. based on rules or service registries. Protocol translation can convert REST APIRepresentational State Transfer Application Programming Interface. An architectural style for web services that uses standard HTTP methods (GET, POST, PUT, DELETE) and stateless communication to manipulate resources identified by URLs. calls to gRPCA high-performance, open-source RPC framework developed by Google that uses Protocol Buffers for serialization and HTTP/2 for transport. Supports bidirectional streaming and is widely used in microservice architectures. or GraphQLA query language and runtime for APIs developed by Meta that allows clients to request exactly the data they need in a single request. Unlike REST, GraphQL uses a single endpoint with a typed schema. queries internally. Aggregation combines responses from multiple services into a single client response, reducing round trips. Observability centralizes logging, metrics, and tracing — feeding data into SyslogA standard protocol (RFC 5424) for transmitting log messages from network devices, servers, and applications to a central log collector. Syslog messages include severity levels from emergency (0) to debug (7). collectors or monitoring pipelines.

Gateway vs. Reverse Proxy

A Reverse ProxyA server that sits in front of backend servers, forwarding client requests and returning responses on their behalf. Used for SSL termination, load balancing, caching, and hiding the origin server's identity. primarily forwards traffic; an API Gateway adds a business logic layer. Gateways often include a developer portal for API key management, throttling policies per consumer, and versioning strategies (URL path, header, or query param). In a MicroservicesAn architectural style that structures an application as a collection of loosely coupled, independently deployable services, each responsible for a specific business function and communicating over APIs. architecture, a gateway prevents the "N x M problem" — N clients each needing to know about M services. The gateway exposes a stable external surface while the internal topology evolves freely. Cloud-managed options (AWS API Gateway, Kong, Apigee) handle scaling automatically, while self-hosted solutions give more control over BandwidthThe maximum data transfer rate of a network link, typically measured in bits per second (Mbps, Gbps). Bandwidth represents capacity, not actual speed; real-world transfer rates depend on latency, congestion, and protocol overhead. and LatencyThe time delay for a data packet to travel from source to destination, typically measured in milliseconds (ms). Lower latency is critical for real-time applications like video calls, gaming, and financial trading. tuning.