What is an API gateway and what does it do?

Question

Accepted Answer

An **API gateway** is a single entry point that sits in front of backend services — handling cross-cutting concerns like routing, authentication, rate limiting, and more. It's especially useful in microservices architectures to centralize common functionality.

## What an API gateway does

```text
The API GATEWAY is a single entry point in front of backend services:
  Client → API GATEWAY → ┬→ Service A
                         ├→ Service B
                         └→ Service C
  → handles cross-cutting concerns in ONE place (so services don't each implement them)
  → routes requests to the right service; abstracts the backend from clients
```

## Common gateway responsibilities

```text
✓ ROUTING → direct requests to the appropriate backend service
✓ AUTHENTICATION/authorization → verify identity/permissions centrally
✓ RATE LIMITING / throttling → protect backends from abuse/overload
✓ Request/response TRANSFORMATION; protocol translation; aggregation (combine service calls)
✓ CACHING; load balancing; SSL termination
✓ LOGGING, monitoring, analytics; error handling
```

## Why use an API gateway

```text
✓ CENTRALIZE cross-cutting concerns → services don't each reimplement auth, rate limiting,
  etc. (DRY, consistent) — especially valuable with many microservices
✓ SINGLE entry point → simpler for clients; hides internal service structure
✓ Consistent security, monitoring, and policies across services
⚠️ but → can become a bottleneck or single point of failure (scale/HA it); adds a layer
→ very common in MICROSERVICES architectures.
```

## Why it matters

Understanding the API gateway is valuable because it's a **common, important component** especially in microservices architectures, centralizing cross-cutting concerns, so it's useful system-design knowledge.

An API gateway — a single entry point in front of backend services — addresses an important need in systems with multiple services: handling **cross-cutting concerns in one place** rather than having every service reimplement them.

Understanding the **common responsibilities** — routing (directing requests to the right service), centralized **authentication/authorization**, **rate limiting**, request/response transformation and aggregation, caching, load balancing, SSL termination, and logging/monitoring — clarifies the breadth of functionality a gateway centralizes.

Understanding **why to use one** is the key value: it **centralizes cross-cutting concerns** (so services don't each reimplement auth, rate limiting, etc. — keeping them DRY and consistent, especially valuable with many microservices), provides a **single entry point** (simpler for clients, hiding internal structure), and ensures consistent security, monitoring, and policies.

Understanding the caveat that a gateway can become a **bottleneck or single point of failure** (requiring scaling and high availability) and adds a layer reflects balanced understanding.

The API gateway is a standard component in microservices architectures (which otherwise would scatter cross-cutting concerns across many services), making it important to understand for modern system design.

Since the API gateway is a common, important component (especially in microservices) that centralizes cross-cutting concerns (routing, auth, rate limiting) at a single entry point, and since understanding what it does and why it's used is valuable for designing service-based systems, understanding the API gateway is valuable, practically-relevant system-design knowledge — a standard component in microservices architectures for centralizing cross-cutting concerns, providing a single entry point and consistent policies, and an important building block for designing systems composed of multiple services.