🔀API Gateway

NEW

Also known as: Gateway, Request Router

Central entry point that routes, secures, and manages API traffic between clients and backend services.

DESCRIPTION

An API gateway sits between clients and microservices, handling routing, authentication, rate limiting, and observability. It simplifies client interactions by providing a unified endpoint and consistent policies. Gateways often integrate with API management for documentation and lifecycle governance. Compared to reverse proxies, gateways add API-specific features like request transformation. In service meshes, gateways complement east-west traffic control by handling north-south ingress.

ALTERNATIVE DEFINITIONS

NGINX

The API gateway is the single entry point for client requests to a microservices application.

Emphasizes single-entry-point role in microservices.

Source

Red Hat

An API gateway is an API management tool that sits between a client and a collection of backend services.

Highlights placement between clients and services with management capabilities.

Source

AWS

Amazon API Gateway is a fully managed service that makes it easy for developers to create, publish, maintain, monitor, and secure APIs at any scale.

Vendor-specific definition emphasizing managed capabilities and scaling.

Source

RELATED TERMS

Microservices Load Balancer OAuth 2.0 Rate Limiting Throttling Backend-for-Frontend OpenAPI API Management

COMPETING TERMS

Service Mesh Reverse Proxy

RELATIONS

• Conforms to: OAuth 2.0
• Narrower: Data API Gateway

KNOWLEDGE AREAS

Infrastructure Software Engineering Data Services Data Integration & Interoperability Platform & Tooling

TARGET AUDIENCE

Software Developer DevOps Engineer Cloud Architect Enterprise Architect

EXTERNAL SOURCES

• Wikipedia - API gateway
• AWS - Getting started with API Gateway
• Microsoft - API management key concepts
• Kong - Kong Gateway introduction
• Istio - Ingress gateway in service mesh

TOP QUESTIONS

Why use an API Gateway?

It centralizes routing, security, and policies, simplifying client access and reducing duplication across services.

Category: Relevancy

How does an API Gateway differ from a reverse proxy?

Reverse proxies focus on HTTP routing, while gateways add API-specific features like authentication, rate limits, and request transformation.

Category: Misunderstanding

What are common API Gateway patterns?

Backend-for-Frontend, auth offloading, request aggregation, and canary routing are widely used patterns.

Category: Example

What are risks of an API Gateway?

It can become a bottleneck or single point of failure. Misconfigured policies may expose services or degrade performance.

Category: Risks

How does an API Gateway interact with a service mesh?

The gateway controls ingress (north-south), while the mesh handles service-to-service traffic (east-west) with mTLS and routing.

Category: Collaboration

What features should an API Gateway provide?

Authentication, authorization integration, rate limiting, throttling, caching, monitoring, and developer portal integration.

Category: Requirements

How to secure APIs via an API Gateway?

Use OAuth/OIDC, mTLS, input validation, and consistent policies. Monitor for abuse with rate limits and anomaly detection.

Category: BestPractice

What metrics monitor an API Gateway?

Latency, error rates, throughput, cache hit ratios, rate-limit events, and authorization failures.

Category: Observability

What is a competing approach to API Gateways?

Service mesh ingress and raw reverse proxies can handle routing, but lack comprehensive API management features.

Category: Alternatives