API gateway

What is an API gateway in simple words

An API gateway is a reverse proxy server that acts as a single entry point for all client requests in an architecture with many microservices. In simple words, it is the “gatekeeper” and “dispatcher” of your service: it accepts all requests from users, determines which microservice to send them to, and returns the response back.

Imagine a large office with many departments. Instead of the client going around all the departments, there is a reception desk (the API gateway). The client says what they need (a request), the reception desk sends it to the needed department (microservice), receives the answer and gives it to the client. The client does not even know which department the needed specialist is in — they simply communicate with the reception desk.

Read about how a microservice architecture works in the article Client-server architecture.

Main API gateway functions

• Routing: Redirecting a request from the client to a specific microservice based on URL, headers or other parameters.
• Authentication and authorization: Verifying the user's identity and access rights before the request reaches the microservice.
• Rate limiting: Protecting services from overloads and DoS attacks — limiting the number of requests from one client.
• Data transformation: Converting request and response formats (for example, XML to JSON), adding or removing HTTP headers.
• Response aggregation: Combining data from several microservices into one response for the client so they do not have to make several requests.
• Monitoring and logging: Collecting statistics on requests, response time and errors for analysis and debugging.
• Load balancing: Distributing requests between several instances of one microservice.

Popular API gateway solutions

• Cloud solutions (Managed): Yandex API Gateway, AWS API Gateway, Azure API Management, Google Cloud Endpoints. Ready-made services that do not require infrastructure management.
• Open Source: Kong, Traefik, Envoy, Tyk, NGINX. Can be deployed on your own servers.
• On-premise solutions: Apigee (Google), IBM API Connect. Full API management platforms.

How an API gateway works in practice

1. The client sends a request to the API gateway address (for example, api.company.com).
2. The API gateway checks authentication — does the client have a valid token? If not, it returns a 401 error.
3. The API gateway checks access rights — can this user perform the requested action? If not, a 403 error.
4. The API gateway checks limits — has the client exceeded the request limit per minute? If exceeded, a 429 error.
5. Routing: By URL path and HTTP method, the gateway determines the needed microservice (for example, /users to the users service, /orders to the orders service).
6. Transformation: If necessary, the gateway converts the request into a format the microservice understands.
7. Request forwarding to the microservice.
8. Getting the response from the microservice.
9. Aggregation: If needed, the gateway combines responses from several microservices.
10. Response transformation: Converting the response into the format expected by the client.
11. Returning the response to the client.

Read about API security in the article WAF (Web Application Firewall).

Advantages of using an API gateway

• Single entry point: Clients do not know about the existence of many microservices — they work with one API.
• Simplified security: All authentication and authorization checks are performed centrally.
• Reduced load on microservices: Microservices do not deal with authentication, limits and logging — they only perform their business logic.
• Flexibility: You can change the backend architecture (add, remove, change microservices) without affecting clients.
• Scalability: The ability to distribute load between several microservice instances.

Disadvantages of an API gateway

• Single point of failure: If the API gateway goes down, the entire system becomes unavailable.
• Latency: Each request passes through an additional “layer”, which increases the response time.
• Configuration complexity: Requires careful configuration of routes, transformation rules and security policies.

Read about high availability in the article Server cluster.