What Is an API Gateway Explained
SkillVeris Team
Cloud & Security Team
An API gateway is a single entry point that sits in front of your backend services and routes each incoming request to the right one.
In this guide, you'll learn:
- It centralises cross-cutting concerns — authentication, rate limiting, TLS termination, and logging — so individual services do not have to reimplement them.
- Clients talk to one stable address while services behind the gateway can change, scale, or move freely.
- Gateways shine in microservices architectures where dozens of services would otherwise each need their own edge logic.
- Popular options include Kong, NGINX, AWS API Gateway, and Envoy, each with different trade-offs.
1What Is an API Gateway?
An API gateway is a server that acts as the single entry point for all client requests to a set of backend services. It receives each request, decides which service should handle it, applies shared policies like authentication and rate limiting, and forwards the request along before returning the response.
Instead of clients knowing the address of every microservice, they know only the gateway. That one stable front door hides the messy, ever-changing topology of the system behind it.
2The Problem It Solves
As a system grows from one application into many services, every service ends up needing the same edge logic: who is calling, are they allowed, are they going too fast, is this HTTPS. Duplicating that across services is wasteful and error-prone.
- Without a gateway, each service reimplements auth, rate limiting, and TLS separately.
- Clients must track many hostnames and ports, which change as services scale.
- Cross-cutting fixes (say a new auth rule) must be rolled out everywhere at once.
- There is no single place to observe or throttle overall traffic.
🔑Key Idea
A gateway pulls cross-cutting concerns out of individual services and into one shared layer. Services shrink to their core business logic; the edge is handled once, consistently.
3What an API Gateway Does
A gateway bundles several responsibilities that would otherwise be scattered. These are the jobs you will configure most often.
- Routing: match a path or host and forward to the correct upstream service.
- Authentication and authorization: validate API keys, JWTs, or OAuth tokens before requests reach services.
- Rate limiting and throttling: cap how many requests a client can make in a window.
- TLS termination: handle HTTPS at the edge so internal traffic can be simpler.
- Request and response transformation: rewrite headers, aggregate responses, or adapt formats.
- Observability: centralised logging, metrics, and tracing for all traffic.
Aggregation
A gateway can also compose responses. A mobile screen might need data from three services; instead of the client making three calls, the gateway fans out, gathers the results, and returns one combined payload. This pattern is sometimes called backend-for-frontend.
4How a Request Flows Through It
Following a single request makes the gateway's role concrete. Each stage is a checkpoint that can pass, transform, or reject the request.
- 1. Client sends a request to api.example.com/orders.
- 2. Gateway terminates TLS and checks the auth token.
- 3. Gateway applies rate-limit rules for that client.
- 4. Gateway matches /orders to the orders service and forwards the request.
- 5. The service responds; the gateway logs, optionally transforms, and returns it.
💡Pro Tip
Keep business logic out of the gateway. It should route, authenticate, and throttle — not make product decisions. A gateway stuffed with custom logic becomes a fragile bottleneck no one wants to touch.
5Gateway vs Load Balancer
An API gateway and a load balancer are often confused because both sit in front of servers, but they operate at different levels and solve different problems.
Load Balancer
A load balancer distributes traffic across identical copies of a service, mostly caring about health and even spreading of load. It typically works at the connection or basic HTTP level and does not understand your API's semantics.
API Gateway
A gateway is application-aware. It reads paths, methods, and tokens, and makes routing decisions based on the meaning of the request. In practice a load balancer often sits in front of a gateway, which in turn sits in front of services.
6Popular API Gateway Tools
Several mature gateways cover this space, from managed cloud services to self-hosted open source.
- Kong: open-source, plugin-driven, built on NGINX; strong for self-hosted setups.
- NGINX: widely used as a lightweight reverse proxy and gateway.
- AWS API Gateway: fully managed, integrates tightly with Lambda and other AWS services.
- Envoy: high-performance proxy, the data plane behind many service meshes.
- Apigee and Azure API Management: enterprise platforms with developer portals and analytics.
7Best Practices
A gateway becomes critical infrastructure the moment it goes live, so treat it with the same care as any core service.
- Run multiple gateway instances behind a load balancer to avoid a single point of failure.
- Keep the gateway stateless so instances can scale horizontally.
- Version your APIs at the gateway so clients migrate at their own pace.
- Push authentication to the edge but still validate trust boundaries inside services.
- Monitor latency added by the gateway; it should be a thin, fast hop.
⚠️Watch Out
Because every request passes through it, a poorly provisioned gateway becomes the bottleneck for your entire system. Load-test it, run redundant instances, and alert on its latency and error rate.
8Common Mistakes to Avoid
Teams tend to trip over the same issues when adopting a gateway.
- Running a single gateway instance with no redundancy, creating a single point of failure.
- Overloading the gateway with business logic until it becomes impossible to change safely.
- Trusting the gateway's auth so completely that internal services skip all verification.
- Adopting a heavy managed gateway for a small system that has only a couple of services.
9Key Takeaways
The essentials of API gateways come down to a few points.
- A gateway is the single front door that routes requests to backend services.
- It centralises auth, rate limiting, TLS, and observability so services stay lean.
- It differs from a load balancer by being application-aware, not just traffic-spreading.
- It is most valuable in microservices; small systems may not need one yet.
- Because all traffic flows through it, make it redundant, stateless, and fast.
10Frequently Asked Questions
Q: Do I need an API gateway for a small app? A: Usually not. If you have one or two services, a simple reverse proxy or even direct access is fine. Gateways earn their keep once you have many services sharing the same cross-cutting concerns.
Q: What is the difference between an API gateway and a reverse proxy? A: A reverse proxy forwards requests and can do basic routing. An API gateway is a specialised reverse proxy that adds API-specific features like auth, rate limiting, request transformation, and aggregation.
Q: Does an API gateway slow things down? A: It adds one network hop and a little processing, typically a few milliseconds. Kept lean and well-provisioned, that cost is far outweighed by the consistency and control it provides.
Q: Can an API gateway handle authentication? A: Yes, that is one of its core jobs. It can validate API keys, JWTs, or OAuth tokens at the edge, rejecting unauthorised requests before they ever reach your services.
Related Reading
Get The Print Version
Download a PDF of this article for offline reading.
About the Publisher
SkillVeris Team
Cloud & Security Team
Our cloud and security experts break down complex infrastructure topics into practical, beginner-friendly guides.
View all postsRelated Posts
Never miss an update
Get the latest tutorials and guides delivered to your inbox.
No spam. Unsubscribe anytime.