An API gateway is a software component that receives requests from an app and sends them to the correct backend API or service. It can also apply shared controls, such as authentication, rate limits, logging, and response formatting. It is especially useful when one web or mobile app communicates with several microservices, but it adds another system that must be configured and monitored carefully.
API Gateway
What Is an API Gateway?
An API gateway is a software entry point that receives an app's API requests and sends them to the right backend service. A client, such as a web or mobile app, uses it instead of calling each microservice directly.
How an API Gateway Works
- An app sends an API request to the gateway.
- The gateway checks identity, input, and traffic rules.
- It routes the request to the correct API endpoint or service.
- It can combine results, such as product, stock, and delivery data for one store screen.
- It returns a single response to the app.
Core API Gateway Functions
Features depend on the product and setup.
- Route requests by path, version, or header.
- Apply API authentication, authorization, and API key checks.
- Validate input, limit request rates, cache responses, transform formats, and record logs and traces.
API Gateway vs Load Balancer vs Service Mesh
| Tool | Main job | Traffic location |
|---|---|---|
| API gateway | Client-facing API controls and routing | App to backend |
| Load balancer | Spread traffic across healthy servers | Client or internal |
| Service mesh | Manage service-to-service communication | Internal |
Benefits of Using an API Gateway
A gateway centralizes shared controls without exposing internal services.
- Simplifies clients that would otherwise call many services.
- Creates a consistent point for security, monitoring, and API versioning.
- Keeps shared policies out of every backend service.
Practical Limits and When Not to Use One
A gateway adds cost, configuration, and a possible failure point unless it is deployed resiliently.
- A small app with one backend may not need a separate gateway.
- Do not put every business rule in it, or debugging becomes harder.
Choosing and Protecting an API Gateway
Check protocol support, identity-provider integration, rate limits, tracing, regions, deployment model, and pricing. Protect it with TLS, least-privilege access, input validation, quotas, rotated secrets, and alerts. AWS API Gateway is one managed implementation.
API Gateways in Emergent Projects
Emergent projects can connect to third-party services, such as a Gmail API integration or a Spotify API app. As integrations and backend services grow, an API gateway can provide a controlled public interface. Build secure API-powered apps with Emergent.
Frequently Asked Questions
Your Questions, Answered
This will automatically populate, don't change
Don't change this element unless you know what you are doing
What is an API gateway and how does it work?
An API gateway is a single entry point for an application's API traffic. It checks a request, applies policies, routes it to a backend service, and returns the response.
Is an API gateway a load balancer?
No. A load balancer distributes traffic among servers. A gateway focuses on API routing and policies, although some gateway products can also perform load-balancing tasks.
What is AWS API Gateway?
AWS API Gateway is Amazon's managed service for creating, publishing, securing, and monitoring APIs. It is a product, while API gateway is the general architectural term.
How does an API gateway handle authentication and authorization?
It can verify credentials such as tokens, API keys, or signed requests. It can then enforce authorization rules before forwarding traffic to a backend service.
How do you protect an API gateway?
Use TLS, strong identity checks, least-privilege permissions, input validation, rate limits, secret rotation, logging, and monitoring. Test policies regularly and restrict administrative access.
Start Building
on Emergent today
on Emergent today
Start Building
