Building block
API gateway
A single entry point for clients in front of a set of services. It handles routing, authentication, limits and logging so each service does not do it on its own.
What a gateway does
A client (website, mobile app) knows one address, api.example.com. The gateway looks at the path and forwards /courses/* to the courses service, /payments/* to payments, /auth/* to the auth service.
On the way it verifies a JWT or API key, applies a rate limit, adds an X-Request-Id for tracing, and writes an access log and metrics. Services behind it receive an already verified request with the user id in a header.
Gateway and BFF
The mobile «My progress» screen needs data from three services. So that a phone on slow 3G does not make three 200 ms requests, the gateway or a separate Backend for Frontend (BFF) assembles the response server side and returns it in one call.
A BFF is usually separate per client type (web, iOS/Android), since they need different data shapes. GraphQL often plays the same role: the client asks for exactly the fields it needs.
Risks
The gateway sits on every request path, so its failure takes everything down. It runs as several copies behind a load balancer and is kept as simple as possible.
Do not turn the gateway into a home for business logic. If discount rules or course access checks start appearing in it, you have built a new monolith that every team must change together.
Pros
- Clients know one address while the internal structure can change.
- Authentication, limits and logging in one place.
- Request aggregation cuts round trips for mobile.
- You can version the API and shift traffic gradually.
Cons
- One more network hop and a few milliseconds of latency.
- A critical point of failure if not made redundant.
- A risk of becoming a dumping ground for business logic.
When to choose it
- There are more than two or three services and several client types.
- You need centralized authentication and rate limiting.
- A public API for partners with keys and quotas.
Where it is used
- Netflix: Zuul, an edge service for routing, authentication and resilience, open sourced in 2013.
Tools
- nginxnginx is a fast web server and reverse proxy that also works as a load balancer and HTTP cache.
- TraefikTraefik is a cloud-native reverse proxy and edge router that discovers services in Docker and Kubernetes and configures routes itself.
- KubernetesKubernetes is a container orchestration system that deploys, scales and heals applications across a cluster of servers.
- AWSThe largest cloud platform, with hundreds of services from virtual machines and storage to databases, queues and ML.
- CloudflareA global network with CDN, DNS, DDoS protection, plus Workers, R2 and D1 for running apps at the edge.
- KeycloakAn open source identity and access management solution with SSO, OIDC, SAML and roles.
- GraphQLA query language and API specification where the client states exactly which fields it needs.
Related topics
Sources
Logos belong to their owners and are used for identification only. Icons: Simple Icons (CC0), Devicon (MIT).