API Gateway
The single entry point in front of your services - auth, routing, rate limiting, observability, and the edge of your platform
API Gateway
An API gateway is the single front door for traffic entering your platform. Every external request — from a browser, a mobile app, a partner system — hits the gateway first. The gateway authenticates the caller, applies rate limits, routes to the right backend, and emits observability signals. Backends never see the raw outside world.
Why Use One
| Without a gateway | With a gateway |
|---|---|
| Every service implements auth, rate limit, CORS, TLS | Cross-cutting concerns handled at the edge |
| Mobile / partner / web clients all hit different services directly | One stable contract; backend changes don't leak |
| Per-service tokens scattered across the org | Central token issuance and validation |
| TLS termination per service | Terminate at the edge; mTLS inside |
| Per-service rate limiting (or none) | Coordinated quotas |
| "Where did the 502 come from?" | Edge logs are the single source of truth for traffic |
Gateway vs Load Balancer vs Service Mesh
These three are easy to confuse — they overlap but solve different problems.
| Load Balancer (L4/L7) | API Gateway | Service Mesh | |
|---|---|---|---|
| Traffic axis | North-south | North-south | East-west (service-to-service) |
| Layer | L4 (TCP) or L7 (HTTP) | L7 only | L7 |
| Auth | Usually none | Yes — JWT/OIDC/API key | Service identity (mTLS) |
| Rate limiting | Crude (LB-level) | First-class | Possible but not the focus |
| API-level features | None | Schema validation, transforms | Retries, timeouts at transport layer |
| Best for | Spreading load across replicas | Exposing services to the outside | Securing & observing internal traffic |
A typical big-platform layout uses all three — a cloud LB in front of an API gateway that fronts a meshed cluster.
Internet
│
▼
┌────────┐
│ LB │ TLS terminate, L4 distribution
└────┬───┘
▼
┌────────────┐
│ API GW │ auth, rate limit, routing, transforms
└────┬───────┘
▼
┌─────────────────────────────────────┐
│ Service Mesh (mTLS, retries, ...) │
│ ┌────┐ ┌────┐ ┌────┐ │
│ │ A │ │ B │ │ C │ ← services │
│ └────┘ └────┘ └────┘ │
└─────────────────────────────────────┘The Players
| Tool | Notes |
|---|---|
| Kong | Lua + Nginx (open-source); strong plugin ecosystem; commercial enterprise edition |
| Envoy / Envoy Gateway | The de-facto edge proxy in modern stacks; programmable; the basis of many other tools |
| Traefik | Auto-discovery, K8s-native, great defaults; LB + gateway in one |
| NGINX / NGINX Plus | Battle-tested; declarative config; K8s Ingress popular |
| HAProxy | Pure L4/L7 LB with edge features; very fast |
| Apigee | Google's managed API platform; enterprise-grade governance |
| AWS API Gateway | Tightly tied to AWS Lambda + REST/HTTP/WebSocket APIs |
| GCP API Gateway / Azure API Management | Cloud-managed equivalents |
| Tyk | Open-source; rich plugin model |
| Cloudflare Gateway / Fastly Compute | Edge-first; CDN integration; serverless edge functions |
For Kubernetes, also consider Gateway API — the spec-driven successor to Ingress that any compliant controller (Envoy Gateway, Istio, Contour, NGINX) can implement.
Learning Path
1. Getting Started
Stand up Kong with Docker Compose, route to a backend, add API-key auth and rate limiting
2. Patterns
Auth (JWT/OIDC/mTLS), rate limiting, request transforms, BFF, schema enforcement
3. Best Practices
HA topology, versioning, observability, security hardening, anti-patterns
What a Gateway Doesn't Do
A common trap is to put business logic in the gateway. Avoid:
- Long-running orchestration
- Cross-service joins / aggregation that look like another service
- Custom business workflows
- Stateful long sessions
The gateway is a policy enforcement and traffic control point, not a service. If your gateway has its own database, you've gone too far.
The smaller your gateway's config diff, the better. Big gateways with hundreds of bespoke transforms become fragile single points of failure. Push business logic back into services; keep the gateway dumb and fast.