Skip to content

Introduction to API Gateway

DodaTech Updated 2026-06-28 6 min read

In this tutorial, you'll learn about API Gateway Introduction. We cover key concepts, practical examples, and best practices to help you understand and apply this topic effectively.

An API Gateway is a server that acts as a single entry point between clients and backend services, handling request routing, composition, and cross-cutting concerns.

What You'll Learn

By the end of this lesson, you will understand what an API gateway is, how it fits into a microservice architecture, and the core problems it solves for distributed systems.

Why It Matters

Without a gateway, every client must know the location of every backend service, authentication logic is duplicated, and cross-cutting concerns are inconsistently applied.

Real-World Use

A large e-commerce platform routes /products to the product service, /orders to the order service, and /auth to the auth service through a single gateway.

Gateway Position in Architecture

flowchart TB
    Client[Client Apps] --> GW[API Gateway]
    GW --> Auth[Auth Service]
    GW --> Product[Product Service]
    GW --> Order[Order Service]
    GW --> Payment[Payment Service]
    style GW fill:#22c55e,color:#fff

What Problems Does a Gateway Solve?

Think of an API gateway like a reception desk in a large office building. Without the reception desk, visitors must know which floor and room each department is on. With the desk, visitors ask one central point, and the desk directs them to the right place.

The same applies to microservices. Without a gateway:

  • Clients need to know the network address of every service
  • Each service must implement its own authentication
  • Rate Limiting is duplicated or missing
  • There's no centralized logging or monitoring

Core Responsibilities

# gateway_concept.py
# Illustrating the core concept of an API gateway
from enum import Enum
from dataclasses import dataclass
from typing import Dict, List, Optional

class RouteMethod(Enum):
    GET = "GET"
    POST = "POST"
    PUT = "PUT"
    DELETE = "DELETE"

@dataclass
class Route:
    path: str
    methods: List[RouteMethod]
    target_service: str
    target_path: str

@dataclass
class GatewayConfig:
    routes: Dict[str, Route]
    rate_limit_per_minute: int
    enable_auth: bool

class APIGateway:
    """Simple API gateway demonstrating core routing."""

    def __init__(self, config: GatewayConfig):
        self.config = config
        self.request_log = []

    def route_request(self, method: str, path: str, headers: Dict) -> dict:
        """Route an incoming request to the appropriate service."""
        matched_route = None
        for route_path, route in self.config.routes.items():
            if path.startswith(route_path):
                matched_route = route
                break

        if not matched_route:
            return {"status": 404, "body": {"error": "Route not found"}}

        route_method = RouteMethod(method)
        if route_method not in matched_route.methods:
            return {"status": 405, "body": {"error": "Method not allowed"}}

        self.request_log.append({
            "path": path,
            "method": method,
            "target": matched_route.target_service,
        })

        return {
            "status": 200,
            "body": {
                "message": f"Routing to {matched_route.target_service}",
                "service": matched_route.target_service,
                "path": matched_route.target_path,
            }
        }

config = GatewayConfig(
    routes={
        "/products": Route(
            path="/products",
            methods=[RouteMethod.GET, RouteMethod.POST],
            target_service="product-service",
            target_path="/api/products",
        ),
        "/orders": Route(
            path="/orders",
            methods=[RouteMethod.GET, RouteMethod.POST],
            target_service="order-service",
            target_path="/api/orders",
        ),
        "/auth": Route(
            path="/auth",
            methods=[RouteMethod.POST],
            target_service="auth-service",
            target_path="/api/auth/login",
        ),
    },
    rate_limit_per_minute=100,
    enable_auth=True,
)

gateway = APIGateway(config)

result1 = gateway.route_request("GET", "/products", {})
print(f"Result 1: {result1}")

result2 = gateway.route_request("POST", "/auth", {})
print(f"Result 2: {result2}")

result3 = gateway.route_request("DELETE", "/products", {})
print(f"Result 3: {result3}")

print(f"\nLogged requests: {len(gateway.request_log)}")

Expected output:

Result 1: {'status': 200, 'body': {'message': 'Routing to product-service', 'service': 'product-service', 'path': '/api/products'}}
Result 2: {'status': 200, 'body': {'message': 'Routing to auth-service', 'service': 'auth-service', 'path': '/api/auth/login'}}
Result 3: {'status': 405, 'body': {'error': 'Method not allowed'}}

Logged requests: 2

Gateway vs Reverse Proxy

A reverse proxy simply forwards requests to backend servers. A gateway adds intelligence: authentication, rate limiting, request transformation, and response aggregation. Every gateway includes reverse proxy functionality, but not every reverse proxy is a gateway.

Features Overview

Feature Description
Routing Direct requests to appropriate backend services
Authentication Verify client identity before forwarding
Rate Limiting Control request frequency per client
Caching Cache responses to reduce backend load
Load Balancing Distribute requests across service instances
Transformation Modify requests and responses en route
Monitoring Log and measure all API traffic

Common Mistakes

1. Treating the Gateway as a Monolith

The gateway should route traffic, not contain business logic. Putting domain logic in gateway plugins makes the system hard to debug and scale.

2. No Health Check Integration

Without health checks, the gateway may route to unhealthy service instances. Always integrate health check endpoints.

3. Single Instance Deployment

A single gateway instance is a single point of failure. Deploy multiple instances behind a load balancer.

4. Ignoring Gateway Latency

Every request passes through the gateway, adding latency. Keep gateway logic lightweight and use async processing.

5. Not Planning for Gateway Failure

When the gateway goes down, all API traffic stops. Design for high availability with redundancy and circuit breakers.

Practice Questions

1. What is the primary role of an API gateway?

It serves as a single entry point that routes requests to appropriate backend services while handling cross-cutting concerns like authentication and rate limiting.

2. How does a gateway differ from a reverse proxy?

A reverse proxy only forwards requests. A gateway adds authentication, rate limiting, request transformation, and other cross-cutting features.

3. What happens when a gateway goes down?

All API traffic is disrupted. This is why gateways must be deployed with redundancy, health checks, and circuit breakers.

4. Why should business logic not be in the gateway?

Business logic in the gateway makes the system hard to debug, test, and scale. The gateway should route and transform, not execute domain rules.

Challenge

Design a gateway routing table for a six-service platform with user management, product catalog, shopping cart, order processing, payment, and notification services.

FAQ

Should every microservice have its own gateway?

No. A single gateway per domain boundary is typical. Each gateway serves a group of related services.

Is API Gateway the same as a service mesh?

No. A service mesh handles inter-service communication. A gateway handles external client-to-service traffic.

Can I use a gateway with a monolithic application?

Yes. A gateway can sit in front of any application type and provides the same benefits: centralized auth, rate limiting, and routing.

What is the performance overhead of a gateway?

Typically 1-5ms per request for lightweight operations. Heavier operations like auth and transformation add more.

Should I build or buy an API gateway?

Build for simple needs. Use Kong, Envoy, or AWS API Gateway for production systems with complex requirements.

Mini Project: Gateway Simulator

# gateway_simulator.py
import time
import json
from typing import Dict, List, Optional

class GatewaySimulator:
    def __init__(self):
        self.services = {}
        self.routes = {}
        self.logs = []

    def register_service(self, name: str, base_url: str):
        self.services[name] = {"base_url": base_url, "healthy": True}

    def add_route(self, path: str, service: str):
        self.routes[path] = service

    def process_request(self, method: str, path: str) -> dict:
        start = time.time()
        self.logs.append({"method": method, "path": path, "timestamp": start})

        matched_service = None
        for route_path, service_name in self.routes.items():
            if path.startswith(route_path):
                matched_service = service_name
                break

        if not matched_service:
            return {"status": 404, "body": "Route not found", "latency_ms": 0}

        if not self.services.get(matched_service, {}).get("healthy", False):
            return {"status": 503, "body": "Service unavailable", "latency_ms": 0}

        latency_ms = (time.time() - start) * 1000
        return {
            "status": 200,
            "body": f"Routed to {matched_service}",
            "target": self.services[matched_service]["base_url"],
            "latency_ms": round(latency_ms, 2),
        }

sim = GatewaySimulator()
sim.register_service("products", "http://products:3000")
sim.register_service("orders", "http://orders:4000")
sim.add_route("/api/products", "products")
sim.add_route("/api/orders", "orders")

for path in ["/api/products", "/api/orders", "/api/users"]:
    result = sim.process_request("GET", path)
    print(f"{path}: {result['status']} -> {result['body']}")

Expected output:

/api/products: 200 -> Routed to products
/api/orders: 200 -> Routed to orders
/api/users: 404 -> Route not found

What's Next

Now understand the reasons for using a gateway. Next, learn why you need an API gateway in detail, then explore reverse proxy patterns.

Built by the developers of DodaTech

Doda Browser, DodaZIP & Durga Antivirus Pro