API Gateway

In the pattern as described by Chris Richardson, the gateway is the single entry point for all clients. It handles requests in one of two ways: some are simply proxied or routed to the appropriate service, and others are fanned out to several services whose results are combined into one response.

A typical request passes through a fixed sequence: TLS is terminated, the caller is authenticated (an API key or a signed token such as a JWT is checked), rate limits are applied, a route is chosen from the path and method, the request is forwarded to a healthy service instance, and the response may be transformed or cached on the way back.

Because clients only see the gateway, services can be split, renamed or moved without changing client code, and the gateway can translate between public web protocols and whatever the services use internally. A common variant, Backends for Frontends, runs a separate gateway for each kind of client, such as web, mobile and third-party, so each gets an API shaped for it.

The costs are another component to build, deploy and keep available, and an extra network hop on every request.

An illustrative, product-neutral gateway configuration showing routing, auth, rate limiting and fan-out.

# Illustrative only: real gateways each have their own config format.
routes:
  - match: { method: GET, path: /products/* }
    upstream: http://catalog-service:8080
    cache: 60s

  - match: { method: POST, path: /orders }
    upstream: http://order-service:8080
    auth: jwt
    rateLimit: { requests: 100, per: minute, key: api_key }

  - match: { method: GET, path: /home }
    aggregate:                     # fan out, merge into one JSON response
      - http://catalog-service:8080/featured
      - http://user-service:8080/me

A mobile app calling GET /home makes one request instead of two, and never learns that two services exist. A client that sends a 101st POST /orders within a minute is rejected at the gateway with 429 Too Many Requests, before the order service does any work.

What is the difference between an API gateway and a load balancer?

A load balancer spreads traffic across instances of the same service and mostly does not care what the requests mean. An API gateway understands the API: it authenticates callers, applies per-client limits, routes different paths to different services, and can combine responses. Gateways often include load balancing or sit in front of load balancers.

What is the difference between an API gateway and a service mesh?

An API gateway handles traffic coming into the system from outside clients. A service mesh handles traffic between services inside the system, typically through a proxy running next to each service. Many architectures use both: the gateway at the edge and the mesh for internal calls.