API Gateway
Single entry point for all clients that handles routing, authentication, rate limiting, and protocol translation.
★★★★★5/5System topology — how multiple services are organised
Interactive visualization
LiveHow it works
An API Gateway acts as the front door to a microservices system. Clients make a single request to the gateway, which routes to the appropriate backend service, handles cross-cutting concerns, and returns a unified response.
Typical responsibilities: authentication & authorisation, SSL termination, rate limiting & throttling, request/response transformation, load balancing, caching, logging and metrics.
The gateway can also aggregate responses from multiple services into a single payload, shielding clients from microservice topology.
Why it matters
Without an API Gateway, each client must know the location and protocol of every service, cross-cutting concerns are duplicated, and there's no single place to enforce security policies.
✓ When to use
- →Microservices with multiple client types (web, mobile, third-party)
- →When centralising auth, rate limiting, or logging
- →Protocol translation (REST to gRPC, WebSocket fan-out)
✗ When NOT to use
- →Single monolith with one client type — adds unnecessary hop
- →When the gateway becomes a bottleneck or deployment bottleneck
Trade-offs
Single entry point — centralised security and observability
Single point of failure if not deployed with HA
Clients decoupled from backend service topology
Can become a 'god gateway' with too much logic
In production
API Gateway + Lambda is the standard serverless stack
Open-source API gateway used by Nasdaq, Honeywell
Zuul gateway handles all inbound traffic before routing to services
Industry adoption
Related principles
Microservices Architecture
LiveDecompose an application into small, independently deployable services that communicate over a network.
Backend for Frontend (BFF)
Create a dedicated backend service for each frontend — web, mobile, and third-party each get their own API tailored to their needs.
Circuit Breaker
LiveAutomatically stop calling a failing service to give it time to recover — preventing cascading failures across distributed systems.
Service Mesh
LiveOffload cross-cutting network concerns (mTLS, retries, circuit breaking, observability) to a dedicated infrastructure layer via sidecar proxies.