What Is an API Gateway
A gateway is a reverse proxy with additional responsibilities. Requests arrive, it applies policy, then forwards them to whichever service should handle them. Because everything passes through it, the gateway is the natural place for cross-cutting concerns. That same position also makes it a single point of failure, which is why gateway deployment requires more care than its apparent simplicity suggests.
A gateway is a reverse proxy with additional responsibilities. Requests arrive, it applies policy, then forwards them to whichever service should handle them. Because everything passes through it, the gateway is the natural place for cross-cutting concerns. That same position also makes it a single point of failure, which is why gateway deployment requires more care than its apparent simplicity suggests.
Directs each request to the appropriate service based on path, host, or header. Clients call one address and remain unaware of how services are organised behind it.
Validates credentials and tokens once at the edge, so individual services can trust the identity passed to them rather than each implementing verification separately.
Enforces per-client request limits, protecting backend services from abuse and from a single misbehaving integration exhausting shared capacity.
Records every request centrally, providing consistent metrics and tracing. Our DevOps services work uses this as the primary source for API monitoring.
Beyond the core functions, gateways commonly handle a set of adjacent concerns that would otherwise be duplicated. Not every deployment needs all of these, and enabling capabilities without a clear reason adds latency and configuration surface. Treat each as a decision rather than a default, since gateway configuration complexity is a common source of production incidents.
Rewrites payloads between what clients expect and what services provide, useful when supporting older client versions without altering internal services.
Caches responses for repeated identical requests, reducing backend load meaningfully for read-heavy endpoints with tolerable staleness.
Routes versioned paths to appropriate service versions, allowing gradual client migration. This pairs with the versioning policy described in our API documentation template.
Combines several backend calls into one client response, reducing round trips for mobile clients on high-latency connections where each request is costly.
A gateway solves problems that appear at a certain scale and complexity. Below that threshold it is infrastructure to operate without corresponding benefit. The clearest signal you need one is duplication, specifically finding the same authentication and rate limiting code in several services with subtle differences between them, which is a maintenance liability waiting to become a security gap.
Several services that clients would otherwise call directly. A gateway gives one entry point and hides internal structure from consumers entirely.
The same authentication or throttling implemented in several places. Centralising removes inconsistency and makes policy changes single-point rather than distributed.
Exposing an API externally requires access control, quotas, and usage visibility. Our API development work treats a gateway as standard for any public interface.
Web, mobile, and partner integrations with different needs. A gateway can shape responses per client type without forking backend services.
Gateways are frequently adopted because they appear in reference architectures rather than because a problem demanded one. For a single service with one client, a gateway adds a hop, a failure point, and a configuration surface without solving anything. Adding it later when you actually have several services is straightforward, so deferring the decision costs little.
One backend service serving one client type gains nothing. Handle authentication and rate limiting in the application until a second service exists.
All traffic passing through one component means gateway capacity and availability bound your entire system. This requires redundancy and careful monitoring to manage properly.
Complex transformation and routing rules in gateway configuration become logic nobody tests. Business logic belongs in services with test coverage, not in proxy configuration.
A load balancer distributes traffic across identical instances. A gateway applies policy and routes by content. Our cloud consulting reviews frequently find one deployed where the other was needed.
Building with What Is an API Gateway? Let's talk.
It is a server sitting in front of your backend services that receives every incoming request, applies policies such as authentication and rate limiting, then forwards the request to the right service. Clients call one address instead of many.
A load balancer distributes traffic evenly across identical instances of one service. A gateway inspects requests, applies policy such as authentication and throttling, and routes to different services based on content. They solve different problems and are often used together.
Usually not. With one backend service and one client type, a gateway adds a network hop, a failure point, and configuration to maintain without solving a problem. Handle authentication and rate limiting in the application and add a gateway when you have several services.
Routing requests to services, authenticating and authorising callers, rate limiting per client, logging and metrics collection, request and response transformation, response caching, version routing, and sometimes aggregating several backend calls into one client response.
It can be, since all traffic passes through it. Production deployments run multiple instances behind a load balancer with health checks and monitoring. The consolidation benefit is real, but it must be paired with redundancy rather than assumed away.
No. Keep the gateway to cross-cutting concerns such as authentication, throttling, and routing. Business logic in proxy configuration is untested code in an unusual place, and it becomes very difficult to reason about as rules accumulate.