What is an API gateway and what role does it play in microservices?
Learn what an API gateway is, how it routes requests and centralizes auth, rate limiting and TLS in microservices, with examples and interview answers.
Expected Interview Answer
An API gateway is a single entry point that sits in front of a microservices system and routes each incoming client request to the correct backend service, while handling cross-cutting concerns like authentication, rate limiting, and TLS termination in one place.
Instead of clients calling dozens of services directly, they call the gateway, which knows the internal topology and forwards, aggregates, or transforms requests as needed. It centralizes concerns that would otherwise be duplicated in every service such as auth, throttling, logging, and request routing, and can compose multiple downstream calls into one client-facing response. This decouples clients from the internal service layout, so services can be split, moved, or renamed without breaking callers.
- Single entry point simplifies clients
- Centralizes auth, rate limiting and TLS
- Hides internal topology from callers
- Can aggregate multiple service calls into one response
- Enables consistent logging, metrics and versioning
AI Mentor Explanation
An API gateway is like the single gate through which every player and official enters the ground. Spectators never wander into the dressing rooms directly; they pass one checkpoint that verifies their pass, directs them to the right stand, and keeps the field itself protected behind one controlled entrance that everyone must funnel through.
Step-by-Step Explanation
Step 1
Client sends one request
The client calls the gateway's public URL instead of individual service hosts.
Step 2
Authenticate and authorize
The gateway validates tokens or API keys and rejects unauthorized traffic before it reaches services.
Step 3
Apply cross-cutting policies
Rate limiting, TLS termination, request logging and header rewriting run here once, centrally.
Step 4
Route or aggregate
The gateway forwards the request to the right service, or fans out to several and merges the responses.
Step 5
Return a shaped response
It transforms and returns a single client-friendly payload, hiding internal service details.
What Interviewer Expects
- Clear definition as a single entry point
- Awareness of cross-cutting concerns it centralizes
- Understanding of routing and response aggregation
- Trade-offs such as it being a potential bottleneck or single point of failure
- Difference between a gateway and a plain load balancer
Common Mistakes
- Confusing an API gateway with a simple load balancer
- Putting business logic inside the gateway
- Ignoring that it can become a single point of failure
- Assuming it removes the need for service-level auth entirely
Best Answer (HR Friendly)
“An API gateway is like a single front door for an application made of many small services. Instead of talking to each service directly, the app talks to the gateway, which checks who you are and sends your request to the right place.”
Code Example
routes:
- path: /orders/**
service: order-service
auth: required
rateLimit: 100/min
- path: /users/**
service: user-service
auth: required
rateLimit: 200/minFollow-up Questions
- How does an API gateway differ from a load balancer?
- What is the backend-for-frontend (BFF) pattern?
- How do you prevent the gateway from becoming a single point of failure?
- How does a service mesh relate to an API gateway?
- Where should authentication live: the gateway, the services, or both?
MCQ Practice
1. What is the primary role of an API gateway in microservices?
A gateway is the single entry point that routes and manages requests to the appropriate backend services.
2. Which concern is commonly centralized at the API gateway?
Cross-cutting concerns like authentication, rate limiting and TLS termination are handled once at the gateway.
3. A risk of an API gateway is that it can become?
Because all traffic flows through it, an under-provisioned gateway can be a bottleneck or single point of failure.
Flash Cards
What is an API gateway? — A single entry point that routes client requests to backend services and handles cross-cutting concerns.
Name three things a gateway centralizes. — Authentication, rate limiting, and TLS termination (also logging and routing).
Gateway vs load balancer? — A load balancer only distributes traffic; a gateway also does auth, routing by path, aggregation and transformation.
Main risk of a gateway? — It can become a bottleneck or single point of failure if not made highly available.