System Design API Gateway
An API gateway is a single entry point that sits between clients and backend services. Every request from a phone, browser, or partner app arrives at the gateway first. The gateway checks the request, decides where it belongs, and forwards it to the right service.
The Problem It Solves
A microservices system may contain dozens of small services. Each service has its own address and its own rules. Clients that talk to every service directly must know all those addresses. A single change in the backend can break every app.
The gateway hides this complexity. Clients learn one address. Engineers rearrange services behind the scenes without touching the apps.
Layman example
A hotel reception desk works like a gateway. Guests never wander into the kitchen, laundry, or storage rooms. They ask the receptionist, and the receptionist directs each request to the correct team.
Architecture Diagram
[Mobile App] [Web Browser] [Partner App]
\ | /
\ | /
v v v
+-----------------------+
| API GATEWAY |
| login check, limits, |
| routing, logging |
+-----------------------+
/ | \
v v v
[User Service] [Order Service] [Payment Service]
Main Jobs of an API Gateway
Request Routing
The gateway reads the request path and sends it to the matching service. A request to /orders reaches the order service. A request to /users reaches the user service.
Authentication and Authorization
The gateway verifies identity once at the door. It checks tokens or API keys and blocks strangers before they touch any service. Each service no longer repeats the same check.
Rate Limiting
The gateway counts requests from each client. It rejects clients that send too many, which protects backend services from overload.
Caching
The gateway stores common responses for a short time. A repeated request for the same product list returns instantly without bothering the service.
Request and Response Transformation
Different clients need different data shapes. The gateway converts formats, such as XML to JSON, or trims large responses for slow mobile networks.
Logging and Monitoring
Every request passes through one place, so the gateway records traffic, errors, and delays in a single log. Teams spot problems faster with this central view.
Request Flow Example
- A customer taps "Place Order" in the mobile app.
- The app sends the request to the gateway.
- The gateway validates the login token.
- The gateway checks the rate limit for this customer.
- The gateway forwards the request to the order service.
- The order service replies, and the gateway returns the answer to the app.
API Gateway vs Load Balancer
| Feature | API Gateway | Load Balancer |
|---|---|---|
| Main goal | Manage and secure API traffic | Spread traffic across identical servers |
| Understands request content | Yes, reads paths and headers | Often only reads network details |
| Handles login checks | Yes | Rarely |
| Typical position | In front of different services | In front of copies of one service |
Many systems use both. The gateway routes to a service, and a load balancer spreads the load across that service's copies.
Backend for Frontend Pattern
Large teams sometimes build one gateway per client type. A mobile gateway returns small responses. A web gateway returns richer data. Each client receives exactly what it needs.
Risks and Solutions
- Single point of failure: run several gateway copies behind a load balancer.
- Extra delay: keep gateway logic light and fast.
- Growing complexity: avoid placing business rules inside the gateway. Keep those in services.
Popular Tools
Teams choose from managed cloud gateways and open-source products such as Kong, NGINX, and cloud provider gateway services. Each one offers routing, security, and monitoring features out of the box.