API Gateway Design

The single front door for many backend services: routing, checking identity once at the edge, rate limits, combining calls, translating protocols, and the Backend for Frontend pattern.

Overview

An API gateway is a server that sits between clients (browsers, phones, partner systems) and the many services behind them. Clients call one address, such as api.shop.com, and the gateway sends each request to the right service. On the way it does the jobs every service would otherwise repeat: checking who the caller is, enforcing rate limits, logging and tracing, and turning errors into one consistent format.

The main benefit is that clients no longer need to know how the backend is split. The gateway maps a public path such as /v1/orders to whatever service owns orders today. Services can be split, merged, moved or redeployed without any client change. A gateway is a kind of reverse proxy: a server that accepts requests on behalf of servers hidden behind it.

The main risk is that everything passes through it. A slow or broken gateway takes the whole product down, and a gateway that slowly gathers business logic becomes a new monolith that every team must change. Good designs keep it thin, stateless and copied many times.

What you will be able to do

  • Draw the path of a request through a gateway and say what each step checks and which error it returns.
  • Explain how the gateway checks a token once and passes a trusted identity to the services behind it.
  • Decide when the gateway should combine several service calls into one, and how to keep that fast.
  • Explain the Backend for Frontend pattern and when one gateway per client type is worth it.
  • Tell an API gateway from a load balancer and from a service mesh.

Key concepts

  • Single entry point
  • Routing and canaries
  • Auth at the edge
  • Rate limits and quotas
  • API composition
  • Protocol translation
  • Backend for Frontend
  • Timeouts and retries
  • Gateway vs service mesh

Interview questions

  • What does an API gateway do, and what should it not do?
  • How does the gateway authenticate a request, and how do services learn who the user is?
  • A mobile screen needs data from five services. How do you make it fast?
  • API gateway vs service mesh: when do you need each?
  • What is the Backend for Frontend pattern, and when is it worth it?
  • How do you stop the gateway from becoming a single point of failure?
  • How should the gateway handle timeouts and retries?
  • How would you release a new version of a service through the gateway safely?

Sign up free to read the full topic

More System Design topics

Start free on Cariara · Coding problems · System design studio