API Gateway Pattern
A single entry point that sits in front of backend services to handle cross-cutting concerns like authentication, rate limiting, routing, and request transformation.
Description
An API gateway is a reverse proxy that acts as the single entry point for all API traffic, sitting between clients and backend services. It handles cross-cutting concerns that would otherwise need to be implemented in every service: authentication and authorization, rate limiting, request/response transformation, SSL termination, request routing, load balancing, caching, and observability (logging, metrics, tracing). By centralizing these concerns, the gateway ensures consistent behavior and reduces duplication across microservices.
Popular API gateway solutions include Kong (open-source, plugin-based), AWS API Gateway (managed, serverless-friendly), Envoy (high-performance, service mesh native), NGINX (reverse proxy with API gateway capabilities), and Traefik (cloud-native, auto-discovery). The choice depends on the deployment model: Kong and NGINX work well for traditional deployments, AWS API Gateway suits serverless architectures, and Envoy is the standard for Kubernetes service meshes.
The gateway pattern introduces a potential single point of failure and a latency bottleneck, so gateway infrastructure must be highly available (multi-AZ deployment, health checks, auto-scaling) and performant (connection pooling, keep-alive, minimal per-request overhead). The Backend for Frontend (BFF) variation deploys separate gateway instances optimized for different client types (web, mobile, third-party), each performing client-specific aggregation and transformation of backend service responses.
Prompt Snippet
Deploy Kong API Gateway in front of all backend services with plugins for JWT validation (jwt plugin verifying RS256 against JWKS), rate limiting (rate-limiting plugin with Redis backing at 1000 req/min per consumer), request correlation (correlation-id plugin setting X-Request-Id), and OpenTelemetry tracing (opentelemetry plugin forwarding spans to Jaeger). Route requests to upstream services via Kong service/route configuration, using path-based routing (/api/v1/invoices -> invoice-service:3000). Deploy in a multi-AZ active-active configuration behind an NLB with health checks on /health.
Tags
Related Terms
API Rate Limiting
Restricting the number of API requests a client can make within a time window to protect backend resources and ensure fair usage.
API Authentication Patterns
Methods for verifying the identity of API consumers, including API keys, OAuth 2.0 Bearer tokens, JWTs, and mutual TLS.
CORS Configuration
Browser-enforced HTTP headers that control which origins, methods, and headers are allowed to make cross-origin requests to an API.
Circuit Breaker Pattern
A resilience pattern that prevents cascading failures by temporarily stopping requests to a failing downstream service after a threshold of errors is reached.