API Gateway

Technical explanation

A gateway can terminate TLS, authenticate clients, authorise requests, apply quotas and rate limits, transform messages, route by version or path, cache responses, aggregate services, and emit telemetry. It provides a managed entry point while hiding internal service topology.

Business relevance

API gateways centralise cross-cutting controls, simplify client integration, and protect backend services. They support consistent policy enforcement and operational visibility across many APIs.

Implementation example

A company places a gateway before payment and account services to validate tokens, enforce per-client quotas, route versions, redact sensitive logs, and monitor latency and errors.

Limitations and common misconceptions

A gateway can become a bottleneck or high-impact failure point. Excessive logic at the gateway increases coupling, and it does not replace secure backend design, service identity, or API lifecycle governance.

Topics

Sources