{"head":{"title":"What Is an API Gateway? Definition and Example | OceanLab","description":"An API gateway is the single front door for an app's APIs. What it does with auth, routing and rate limits, an example and the mistakes teams make with it.","canonical":"https://oceanlab.in/glossary/api-gateway"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"API gateway","path":"/glossary/api-gateway"}],"slug":"api-gateway","term":"API gateway","aka":[],"category":"System design","short":"A single entry point that sits in front of a system's APIs and handles routing, auth and limits for every request.","body":[["Clients such as a mobile app, a web app or a partner integration send every request to the gateway instead of calling each service directly. The gateway checks who is calling, applies ",{"href":"/glossary/rate-limiting","text":"rate limiting"},", routes the request to the right service and can reshape the response."],["It is common in ",{"href":"/glossary/microservices","text":"microservices"}," setups, where it hides many internal services behind one public address. It is also used in front of a single back end, simply to keep auth, logging and limits in one place."]],"why":["Without a gateway, every service has to repeat the same checks, and a mistake in any one of them is a hole. A gateway puts those cross-cutting rules in one place, so they are consistent and easy to change. It also gives one place to see all API traffic."],"example":["A logistics platform has separate services for orders, drivers and billing. Its mobile app talks to one gateway. The gateway checks the user's ",{"href":"/glossary/oauth","text":"OAuth"}," token, limits each account to a fair number of calls per minute and sends /orders to the order service and /invoices to billing."],"inBuild":["We usually set up the gateway early, even with one back end, because adding it later means changing every client. Auth checks, request IDs, rate limits and access logs live there, and each service still checks permissions for its own data."],"mistakes":[["Putting business logic in the gateway. It becomes a second back end nobody owns."],["Trusting the gateway alone. Services should still check that the caller may touch the data they ask for."],["Making it a single point of failure with one instance and no health checks."]],"related":[{"href":"/glossary/microservices","label":"Microservices","detail":"A way of building an application as many small services, each owning one job and its own data, deployed independently."},{"href":"/glossary/rate-limiting","label":"Rate limiting","detail":"Capping how many requests a user, API key or address can make in a given time, to protect a system and share capacity fairly."},{"href":"/glossary/oauth","label":"OAuth 2.0","detail":"A standard that lets an app get limited access to a user's account on another service, without ever seeing their password."},{"href":"/glossary/load-balancer","label":"Load balancer","detail":"A service that spreads incoming traffic across several servers, and stops sending traffic to any that fail their health checks."},{"href":"/glossary/webhook","label":"Webhook","detail":"An HTTP request one system sends to a URL you choose as soon as an event happens, so you do not have to keep asking."}],"tools":[],"links":[{"href":"/software","label":"Software by industry","detail":"Systems we build per industry, with guides and tools."}],"sources":[],"legal":false,"updatedAt":"2026-10-25"}