codequest / system design
Core concept 13 of 21

API gateway

One front door for every client: routing, authentication, rate limits and response shaping in one place.

One front door

When a backend is split into many services, clients shouldn't need to know where each one lives. An API gatewayis the single entry point: every request comes to it, and it routes the request to the right service.

Web appMobile appPartner APIAPI gatewayauth · rate limitsrouting · TLSlogging · cachingUsers serviceOrders servicePayments serviceSearch service
Clients talk to one host; the gateway handles the shared concerns and forwards each call to the right service.

What it handles

  • Routing: /orders/* to the orders service, /search to search, and so on.
  • Authentication: check tokens once at the edge, so services can trust the identity they receive.
  • Rate limiting and quotas per client or API key.
  • TLS termination, logging, metrics, request IDs for tracing a call through many services.
  • Response shaping: combine several service calls into one response for a mobile screen (the "backend for frontend" pattern).

Gateway vs load balancer

A load balancer spreads traffic across identical copies of one service. A gateway understands the API and sends different requests to different services. Large systems use both: a load balancer in front of several gateway instances, and load balancers in front of each service.

Watch out for

  • It's on every request, so it must be stateless, horizontally scaled and highly available.
  • Keep business logic out of it. A gateway full of special cases becomes a bottleneck for every team.
  • It adds a network hop, usually a few milliseconds.

In the interview

  • With several services, put a gateway at the front and list what it does: auth, rate limiting, routing.
  • Say it's stateless and scaled behind a load balancer, so it isn't a single point of failure.
  • Managed options (AWS API Gateway, Kong, Envoy-based gateways) are fine to name.