KAHIBARO
Discord Login Register ☰
☰

27.8. API Gateways

Table of Contents

Why API Gateways Exist

In a simple backend, a client talks directly to one server, for example a single REST API. In more complex systems, especially with microservices, there are many backend services, each with its own API.

Without an API gateway:

An API gateway sits between clients and backend services and acts as a single entry point.

Client → API Gateway → Many backend services

This lets you:

Key idea: An API gateway is the single public front door to your backend, routing and shaping traffic to internal services.

Core Responsibilities of an API Gateway

Request Routing

The most basic job of an API gateway is to send each client request to the correct internal service.

Examples:

A typical routing table might look like this:

Path prefixHTTP methodTarget serviceExample URL
/usersanyuser-service/users/42
/ordersanyorder-service/orders/1001
/productsanyproduct-service/products?category=TV
/authanyauth-service/auth/login

The gateway inspects:

Then it forwards the request to the appropriate backend URL, for example http://user-service.internal/api/users/42.

From the client view, there is only one base URL, such as:

The gateway hides internal network details like:

Aggregation (API Composition)

Sometimes the client needs data that lives in multiple services. Without a gateway, the client would have to call each service itself.

Example: A mobile app dashboard needs:

Instead of making 3 separate calls from the app, the gateway can:

  1. Receive GET /me/dashboard.
  2. Call:
    • GET /internal/users/me
    • GET /internal/orders?user_id=123&limit=5
    • GET /internal/recommendations?user_id=123
  3. Combine results into one response and return it to the client.

Benefits:

Centralized Authentication and Authorization

The gateway can sit in front of your auth logic and enforce security rules.

Typical tasks:

Example flow:

  1. Client sends Authorization: Bearer <token> to api.example.com.
  2. Gateway verifies token using a public key.
  3. If invalid, it returns 401 Unauthorized.
  4. If valid, it sets headers like:
    • X-User-Id: 123
    • X-User-Roles: admin,editor
  5. Backend services trust the gateway and use these headers instead of parsing the token themselves.

Important: With a gateway, services can be simpler and safer by offloading authentication and many access checks to the gateway.

Rate Limiting and Throttling

To protect your backend from abuse and overload, the gateway can limit:

Examples:

Typical strategies:

StrategyDescription
Fixed windowCount per fixed period, for example per minute.
Sliding windowCount over a moving time window.
Token bucket / leakyAllow bursts but maintain average rate.

Instead of implementing this in every service, you configure it once in the gateway.

Request and Response Transformation

The gateway can modify:

Common transformations:

This makes it possible to evolve internal services without breaking public APIs.

API Gateway vs Reverse Proxy vs Load Balancer

These terms are related and sometimes overlap, but they are not identical.

ComponentMain purposeTypical layer
Load balancerDistribute traffic across identical serversNetwork / transport level
Reverse proxyForward requests to backend serversHTTP level
API gatewayManage and expose APIs with rich featuresApplication / API level

Reverse Proxy

A reverse proxy forwards incoming HTTP requests to one or more backend servers. It often:

Example tools: Nginx, Apache HTTP Server, HAProxy.

Load Balancer

A load balancer spreads incoming traffic across many instances of the same service, for example:

Client → Load balancer → 3 instances of api-service

It aims to:

Some reverse proxies also act as load balancers, for example Nginx.

API Gateway

An API gateway is usually built on top of reverse proxy capabilities and adds:

You can think of an API gateway as a smart reverse proxy specialized for APIs.

Rule of thumb: Every API gateway is a reverse proxy, but not every reverse proxy is a full API gateway.

Typical Features of API Gateways

Authentication and API Keys

Gateways often support:

Examples:

Rate Limiting and Quotas

Gateways often provide configurable policies, such as:

The configuration is usually declarative. For example, in pseudocode:

yaml 
routes:
  - path: /v1/*
    rate_limit:
      key: api_key
      limit: 1000
      window: 1h

Caching

Gateways can cache responses to reduce load on services.

Examples:

This is especially useful for:

Monitoring, Metrics, and Logging

Since all traffic goes through the gateway, it is a great place to collect:

Many gateways provide dashboards to visualize:

The gateway can also add correlation ids such as X-Request-Id to help trace requests across services.

Versioning and Routing by Host

Gateways make it easier to manage API versions and multiple APIs.

Examples:

You can perform canary releases, routing a small percentage of traffic to a new version.

Request Validation and Security Filters

Some gateways can:

This gives you a basic security layer before your own code runs.

Example API Gateway Flows

Simple Routing Example

Imagine you have 3 microservices:

Your public domain is https://api.shop.com.

The gateway config might say:

yaml 
routes:
  - path_prefix: /users
    upstream: http://users.internal:8000
  - path_prefix: /orders
    upstream: http://orders.internal:8001
  - path_prefix: /products
    upstream: http://products.internal:8002

Requests:

Aggregation Example

Add a new endpoint to the gateway:

GET /me/summary

Gateway logic, in pseudocode:

python 
@app.get("/me/summary")
def summary(request):
    user_id = request.headers["X-User-Id"]
    profile = http_get(f"http://users.internal:8000/users/{user_id}")
    orders = http_get(f"http://orders.internal:8001/orders?user_id={user_id}&limit=3")
    return {
        "user": profile.json(),
        "recent_orders": orders.json(),
    }

The client makes a single request and gets combined data from multiple services.

Basic Token Validation Example

Gateway middleware pseudocode:

python 
def auth_middleware(request, next_handler):
    token = extract_bearer_token(request.headers.get("Authorization", ""))
    if not token:
        return Response(status_code=401, json={"detail": "Missing token"})
    try:
        payload = jwt_decode(token, public_key)
    except InvalidTokenError:
        return Response(status_code=401, json={"detail": "Invalid token"})
    # Attach user info to the request
    request.headers["X-User-Id"] = payload["sub"]
    request.headers["X-User-Roles"] = ",".join(payload.get("roles", []))
    # Pass request to route handler or upstream service
    return next_handler(request)

All services behind the gateway can assume that:

Common API Gateway Products and Tools

You do not have to write an API gateway from scratch. Many tools exist.

CategoryExamples
Cloud managed gatewaysAWS API Gateway, Azure APIM, GCP APIG
Open source gatewaysKong, Tyk, KrakenD, APISIX
Service mesh gatewaysIstio Gateway, Linkerd ingress
Reverse proxies with pluginsNginx, Traefik, Envoy

For backend development with Python and FastAPI, you will often see:

Each product differs in configuration format, but conceptually they all provide:

Benefits and Trade‑Offs

Benefits

Trade‑Offs and Risks

Good practice: Keep business rules inside your services, and use the API gateway mainly for routing, security, and common infrastructure concerns.

API Gateways in a Microservices Architecture

In a microservices system, you often have this structure:

Client → API Gateway → Many microservices

Internally, you might also have:

Typical pattern:

You do not need this complexity at the beginning, but it is important to understand how gateways fit into larger architectures.

When You Need an API Gateway

In small systems, a simple reverse proxy like Nginx in front of a single backend application is enough. You should consider an API gateway when:

For many beginner projects, you will:

Example: Simple API Gateway Design for a Backend Project

Imagine you built several FastAPI services:

You want:

A minimal design:

  1. Use an API gateway (for example Kong or AWS API Gateway).
  2. Configure routes:
    • /auth/* → auth-api
    • /users/* → user-api
    • /shop/* → shop-api
  3. Configure auth:
    • For /auth/*:
      • Allow anonymous requests for /login and /register.
    • For /users/ and /shop/:
      • Require valid JWT.
      • Extract user_id and forward as header.
  4. Configure rate limits:
    • Logged in users: 2000 requests per hour.
    • Anonymous endpoints: 50 requests per hour per IP.

This setup gives you:

Views: 6

Comments

Please login to add a comment.

Don't have an account? Register now!

© 2025 Kahibaro
Visitors: 3691 / 24h
Impressum / Imprint
Datenschutz / Data Policy