API Gateway 🚪 — The Single Entry Point for APIs

An API Gateway is a single entry point between clients and backend services. It receives client requests, applies common policies, and forwards requests to the appropriate microservice.

flowchart LR
    C["Client"] --> G["API Gateway"]

    G --> U["User Service"]
    G --> O["Order Service"]
    G --> P["Payment Service"]
    G --> N["Notification Service"]

1. Why Do We Need an API Gateway?

• Single public endpoint
• Request routing
• Authentication and authorization
• Rate limiting
• Request/response transformation
• Logging and monitoring
• API versioning
• Load balancing
• Sometimes caching

2. Without API Gateway

Clients need to know about individual services.

flowchart LR
    C["Client"] --> U["User Service"]
    C --> O["Order Service"]
    C --> P["Payment Service"]
    C --> N["Notification Service"]

This exposes internal service details and makes client-side integration more complicated.

3. With API Gateway

flowchart LR
    C["Client"] --> G["API Gateway"]

    G --> U["User Service"]
    G --> O["Order Service"]
    G --> P["Payment Service"]
    G --> N["Notification Service"]

The client only needs to know the gateway endpoint.

4. Request Routing

The gateway can route requests based on URL paths, HTTP methods, headers, hostnames, or other rules.

flowchart LR
    C["Client"] --> G["API Gateway"]

    G -->|"/users"| U["User Service"]
    G -->|"/orders"| O["Order Service"]
    G -->|"/payments"| P["Payment Service"]

5. Authentication

Authentication can be handled at the gateway before forwarding the request to backend services.

sequenceDiagram
    participant C as Client
    participant G as API Gateway
    participant A as Auth Service
    participant S as Backend Service

    C->>G: Request + Access Token
    G->>A: Validate Token
    A-->>G: Valid
    G->>S: Forward Request
    S-->>G: Response
    G-->>C: Response

Depending on the architecture, services may still perform their own authorization checks.

6. API Gateway vs Reverse Proxy

7. API Gateway vs Load Balancer

8. API Gateway in Microservices

flowchart LR
    C["Web / Mobile Clients"] --> G["API Gateway"]

    G --> A["Catalog Service"]
    G --> B["Order Service"]
    G --> C2["Payment Service"]

    A --> DB1["Catalog DB"]
    B --> DB2["Order DB"]
    C2 --> DB3["Payment DB"]

A common architecture is: Client → API Gateway → Microservices.

9. API Gateway as a Security Boundary

The gateway can enforce common policies before traffic reaches internal services.

flowchart LR
    C["Internet"] --> G["API Gateway"]

    G --> A["Authentication"]
    G --> R["Rate Limiting"]
    G --> V["Request Validation"]

    A --> S["Internal Services"]
    R --> S
    V --> S

10. What If the API Gateway Goes Down?

The gateway can become a critical dependency. Therefore, it should not be deployed as a single instance.

flowchart LR
    C["Clients"] --> LB["Load Balancer"]

    LB --> G1["API Gateway 1"]
    LB --> G2["API Gateway 2"]
    LB --> G3["API Gateway 3"]

    G1 --> S["Services"]
    G2 --> S
    G3 --> S

Multiple gateway instances provide high availability and allow horizontal scaling.

11. Common API Gateway Technologies

• AWS API Gateway
• Azure API Management
• Apigee
• Kong
• NGINX
• YARP

Important Interview Questions

• What is an API Gateway?
• Why do we need an API Gateway?
• API Gateway vs Reverse Proxy?
• API Gateway vs Load Balancer?
• Where should authentication happen?
• Can API Gateway perform rate limiting?
• What happens if the API Gateway fails?
• How do you scale an API Gateway?
• Can an API Gateway route requests to different microservices?
• What is the difference between API Gateway and BFF?

Key Takeaways

• API Gateway provides a single entry point for APIs.
• It hides internal microservices from clients.
• It can handle routing, authentication, rate limiting and transformations.
• It is commonly used in microservices architectures.
• Gateway instances should be horizontally scalable and highly available.
• API Gateway is more API-policy focused than a basic reverse proxy.

Conclusion

For interviews, remember: Client → API Gateway → Microservices. The gateway centralizes common API concerns while keeping backend services focused on business logic.