API Gateway

• API gateway : a single entry point that sits in front of a set of microservices and handles cross-cutting concerns on their behalf.
• Authentication : the gateway validates a token such as a JWT, confirms the caller's identity, and forwards the verified user downstream.
• Rate limiting : controls how many requests a client may make, rejecting excess with HTTP 429.
• Routing and load balancing : matches the request to the correct backend service and spreads requests across healthy instances.
• TLS termination : handles encryption with the client so internal traffic can use simpler or mutually authenticated channels.
• Transformation : adapts between external and internal formats, aggregating responses, stripping internal fields, or adding headers.

What is an API gateway?

An API gateway is a single entry point that sits in front of all microservices and handles the cross-cutting concerns that every service would otherwise have to implement on its own. Clients talk to one address instead of knowing every service's location, which decouples them from the internal service topology and lets services move, split, or scale without breaking clients.

How does the gateway handle authentication?

Authentication and authorization happen at the gateway so each service does not re-implement them. The gateway validates a token, such as a JWT, confirms the caller's identity, and can enforce coarse permissions before forwarding, rejecting unauthenticated requests early.

package com.bank.gateway;

public class AuthFilter {
    public Response handle(Request req) {
        if (!auth.validate(req.token())) {
            return Response.status(401).body("Unauthorized");
        }
        String userId = auth.subject(req.token());
        req.addHeader("X-User-Id", userId);   // pass verified identity downstream
        return routeToBackend(req);
    }
}

How does rate limiting work at the gateway?

Rate limiting protects downstream services from abuse and overload. It is applied per client or per API key and returns HTTP 429 Too Many Requests when the limit is exceeded. Placing rate limiting at the gateway means bad traffic is rejected at the front door before it consumes any downstream resources.

package com.bank.gateway;

public class RateLimitFilter {
    public Response handle(Request req) {
        String clientId = req.header("X-Api-Key");
        if (!rateLimiter.allow(clientId)) {
            return Response.status(429)
                .header("Retry-After", "10")
                .body("Too Many Requests");
        }
        return next(req);
    }
}

How does routing and load balancing work?

Routing matches the request path or host to the correct backend service. Load balancing spreads requests across that service's healthy instances, skipping any that fail health checks.

package com.bank.gateway;

public class Router {
    public String route(Request req) {
        if (req.path().startsWith("/api/transfers")) return "transfer-service";
        if (req.path().startsWith("/api/accounts"))  return "account-service";
        if (req.path().startsWith("/api/statements")) return "statement-service";
        return "default-service";
    }

    public String selectInstance(String service) {
        var healthy = registry.healthyInstances(service);
        return healthy.get(counter.getAndIncrement() % healthy.size());
    }
}

What is TLS termination?

TLS termination means the gateway handles encryption with the client, so internal traffic can use simpler or mutually authenticated channels. This centralizes certificate management in one place rather than managing certificates on every individual service.

How does request and response transformation work?

Transformation lets the gateway adapt between the external API and internal formats. It can aggregate several service calls into one response for a mobile client, strip internal fields before sending the response, add headers like trace ids, or manage API versioning.

package com.bank.gateway;

public class TransformFilter {
    public Response transform(Response internalResponse) {
        var body = internalResponse.body();
        body.remove("internalAuditId");     // strip internal field
        body.put("apiVersion", "v2");       // add version info
        return Response.ok(body);
    }
}

What are common mistakes with API gateways?

The most common mistake is putting business logic in the gateway, turning it into a fat gateway that becomes both a bottleneck and a single point of failure. The gateway should do cross-cutting concerns only. Fine-grained, data-specific authorization often still belongs in the services that own the data.

package com.bank.gateway;

public class GatewayAntiPattern {
    // WRONG: business logic in the gateway
    // if (amount > 100000) requireManagerApproval();
    // This belongs in the transfer service, not the gateway.

    // CORRECT: gateway does cross-cutting only
    // authenticate -> rate-limit -> route -> transform
}

What should a senior engineer know?

A senior engineer keeps the gateway thin, scales it horizontally, and deploys it as a highly available pair so the gateway itself is not a single point of failure. They know that sensitive logic like fine-grained authorization belongs in the services that own the data, not at the edge. They also know that the gateway is the ideal place for observability : injecting trace ids, logging request metadata, and collecting latency metrics for every API call.

What are common API gateway implementations?

Popular implementations include Kong (open-source, plugin-based), Spring Cloud Gateway (Java ecosystem), AWS API Gateway (managed, serverless), and Envoy (high-performance proxy often used with service meshes). The choice depends on the team's ecosystem and operational maturity.