API Gateway

An API gateway is a single entry point for API traffic. Clients call the gateway, which authenticates the request, applies limits, routes it to the correct backend service and returns the response, often adding logging and metrics along the way.

Why it matters

In a system of many services, putting common concerns in one place avoids repeating them everywhere. A gateway can validate API keys or tokens, enforce rate limits, transform requests, cache responses, handle CORS and terminate TLS. It also hides internal service layout so backends can change without breaking clients. Managed examples include Amazon API Gateway, Azure API Management and Kong, plus open-source proxies.

It is also a potential bottleneck and single point of failure, so it needs redundancy and monitoring.

Example

GET https://api.example.com/v1/orders/42
 -> gateway checks bearer token
 -> gateway applies 100 requests/min limit
 -> routes to orders-service:8080

Over the limit, the client gets 429 Too Many Requests without the backend being touched.

Common mistakes

• Putting heavy business logic in the gateway.
• Relying on it as the only security layer, leaving internal services unauthenticated.
• Setting timeouts shorter than the backend needs, causing 504 errors.

Related

• Reverse proxy
• Rate limiting
• REST API
• Microservices

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.