API Gateway — Complete Guide to Traffic Management

In this tutorial, you will learn about API Gateway. We cover key concepts, practical examples, and best practices to help you master this topic.

An API gateway is a reverse proxy that sits between clients and backend services, handling request routing, authentication, rate limiting, caching, and protocol translation for all incoming API traffic.

What You'll Learn

• What an API gateway is and its core responsibilities
• How gateways improve security, performance, and observability
• Common gateway patterns and deployment strategies

Why It Matters

Without a gateway, each microservice must independently handle authentication, rate limiting, logging, and CORS. A gateway centralizes these cross-cutting concerns so backend services focus on business logic.

Real-World Use

Doda Browser's sync service routes all client requests through an API gateway that authenticates the user, checks rate limits, logs the request, and forwards it to the appropriate sync microservice.

flowchart LR
    C["Client"] --> G["API Gateway"]
    G --> A["Auth Service"]
    G --> B["User Service"]
    G --> D["Data Service"]
    G --> E["Rate Limiter"]
    G --> F["Logger"]
    style G fill:#dbeafe,stroke:#2563eb

Code Examples

from flask import Flask, request, jsonify
import requests

app = Flask(__name__)

# Simple gateway that routes to backend services
SERVICE_MAP = {
    '/users': 'http://user-service:5001',
    '/orders': 'http://order-service:5002',
    '/payments': 'http://payment-service:5003',
}

@app.route('/<path:path>', methods=['GET', 'POST', 'PUT', 'DELETE'])
def gateway(path):
    backend_url = SERVICE_MAP.get('/' + path.split('/')[0])
    if not backend_url:
        return jsonify({'error': 'Service not found'}), 404
    target = f"{backend_url}/{path}"
    resp = requests.request(
        method=request.method,
        url=target,
        headers={k: v for k, v in request.headers if k.lower() != 'host'},
        data=request.get_data(),
    )
    return resp.content, resp.status_code, resp.headers.items()

Expected output: The gateway proxies requests to the correct backend service based on URL prefix.

// Express API gateway with rate limiting
const express = require('express');
const rateLimit = require('express-rate-limit');
const { createProxyMiddleware } = require('http-proxy-middleware');

const app = express();

const limiter = rateLimit({
  windowMs: 60 * 1000,
  max: 100,
  message: { error: 'Too many requests' },
});

app.use('/api', limiter);
app.use('/api/users', createProxyMiddleware({ target: 'http://users:5001', changeOrigin: true }));
app.use('/api/orders', createProxyMiddleware({ target: 'http://orders:5002', changeOrigin: true }));

app.listen(8080, () => console.log('Gateway on :8080'));

Expected output: Gateway listens on port 8080, applies rate limiting, and proxies requests to Microservices.

# Kong declarative gateway config (YAML)
# _format_version: "3.0"
# services:
#   - name: user-service
#     host: user-service.internal
#     port: 5001
#     protocol: http
#     routes:
#       - name: user-route
#         paths: ["/users"]
#         methods: ["GET", "POST"]
#   - name: order-service
#     host: order-service.internal
#     port: 5002
#     protocol: http
#     routes:
#       - name: order-route
#         paths: ["/orders"]
#         plugins:
#           - name: rate-limiting
#             config:
#               minute: 50

Expected output: Kong gateway routes /users to user-service and /orders to order-service with rate limiting.

Common Mistakes

1. Making the Gateway a Single Point of Failure

Deploy at least two gateway instances behind a load balancer. A single gateway can take down the entire system.

2. Putting Business Logic in the Gateway

The gateway should handle cross-cutting concerns only. Business logic belongs in backend services.

3. Ignoring Gateway Latency

Each request passes through the gateway, adding 5-50ms of latency. Keep gateway processing lightweight.

4. Not Enforcing Timeouts

Without request timeouts, a slow backend can exhaust gateway resources and block all traffic.

5. Exposing the Gateway Directly to the Internet

Place the gateway behind a CDN or Web Application Firewall (WAF) for DDoS protection and TLS termination.

Practice Questions

1. What three cross-cutting concerns does an API gateway typically handle?
2. Why should business logic not be placed in the gateway?
3. How does an API gateway differ from a load balancer?
4. What happens to the system if the gateway goes down?
5. How can you prevent the gateway from becoming a performance bottleneck?

Answers:

1. Authentication, rate limiting, and request logging.
2. Business logic in the gateway couples services to the gateway, making scaling and independent deployment harder.
3. A load balancer distributes traffic across instances; a gateway routes traffic to different services.
4. All API traffic stops — deploy multiple gateway instances for high availability.
5. Use asynchronous processing, connection pooling, and keep gateway middleware lightweight.

Challenge: Design an API gateway for a ride-sharing app with services for drivers, riders, payments, and notifications. Define routes, rate limits, and authentication for each.

FAQ

Mini Project

Build a mini API gateway using Express or Flask that routes requests to three mock backend services, applies rate limiting (100 req/min), logs every request, and returns a 429 when the limit is exceeded.

What's Next

Explore API lifecycle management to understand how gateways fit into broader API operations, or see API security patterns for securing gateway endpoints.