API gateway
A single entry point that sits in front of a system's APIs and handles routing, auth and limits for every request.
Last updated
What it is.
Clients such as a mobile app, a web app or a partner integration send every request to the gateway instead of calling each service directly. The gateway checks who is calling, applies rate limiting, routes the request to the right service and can reshape the response.
It is common in microservices setups, where it hides many internal services behind one public address. It is also used in front of a single back end, simply to keep auth, logging and limits in one place.
Why it matters
Without a gateway, every service has to repeat the same checks, and a mistake in any one of them is a hole. A gateway puts those cross-cutting rules in one place, so they are consistent and easy to change. It also gives one place to see all API traffic.
In a product build
We usually set up the gateway early, even with one back end, because adding it later means changing every client. Auth checks, request IDs, rate limits and access logs live there, and each service still checks permissions for its own data.
Common mistakes.
- 01
Putting business logic in the gateway. It becomes a second back end nobody owns.
- 02
Trusting the gateway alone. Services should still check that the caller may touch the data they ask for.
- 03
Making it a single point of failure with one instance and no health checks.
Related terms.
- MicroservicesA way of building an application as many small services, each owning one job and its own data, deployed independently.
- Rate limitingCapping how many requests a user, API key or address can make in a given time, to protect a system and share capacity fairly.
- OAuth 2.0A standard that lets an app get limited access to a user's account on another service, without ever seeing their password.
- Load balancerA service that spreads incoming traffic across several servers, and stops sending traffic to any that fail their health checks.
- WebhookAn HTTP request one system sends to a URL you choose as soon as an event happens, so you do not have to keep asking.
