API gateway

What is an API gateway?

An API gateway is a server that sits between client applications and your backend services. Instead of a mobile app or website calling ten different services directly, it sends every request to one address. The gateway checks who is calling, applies limits, routes the request to the right service and returns the response. It becomes the front door of your application programming interface layer.

The pattern became common with microservices, where a single screen may depend on many small services. Without a gateway, each client must know every service address, handle each authentication scheme and cope with each failure. The gateway removes that burden from the client.

‍

How an API gateway works

When a request arrives, the gateway runs it through a chain of steps before any backend code executes.

• Authentication and authorisation: validate API keys, JWT tokens or OAuth access.
• Rate limiting and throttling: cap requests per client to protect services from abuse.
• Routing: map a public path to an internal service.
• Transformation: rewrite headers, merge responses or convert formats.
• Caching: serve repeated responses without hitting the backend.
• Logging and metrics: record every call for monitoring and billing.

A simplified routing rule looks like this:

GET /api/orders/* → orders-service:8080
GET /api/users/* → users-service:8081
policy: require_jwt, rate_limit=100/min

‍

Main features and benefits

A gateway centralises concerns that would otherwise be repeated in every service. Security rules live in one place, which reduces the risk of a forgotten check. Clients get a stable contract even when services behind it change. Teams can version an API, retire old routes and roll out changes gradually. Observability improves because every call passes through one point that can log latency, errors and usage.

Cross-cutting concerns it handles

TLS termination, CORS headers, request validation, IP allow lists and response compression are typical examples. Handling them at the edge keeps the services themselves simple.

‍

API gateway vs reverse proxy vs load balancer

These components overlap, which causes confusion. A gateway is application-aware, while the others work at a lower level.

‍

When to use one, and when not to

A gateway pays off when you expose several services, serve multiple client types, need consistent security or sell API access. It is often unnecessary for a small application with a single backend, where it adds latency, cost and one more component to operate. Remember that a gateway is also a single point of failure, so it should run in a redundant setup.

• Keep business logic out of the gateway.
• Version your routes from day one.
• Monitor latency added by each policy.
• Document the public contract, for example with OpenAPI.

‍

Common options

Managed gateways exist at every major cloud provider, and open source gateways such as Kong run on your own infrastructure. For lighter needs, an edge platform like Cloudflare can enforce authentication and rate limits in front of any backend, and low-code backends such as Xano expose managed API endpoints with built-in access control.

‍

API gateways at BeBranded

When we build web applications that rely on several services, we decide early whether a gateway is justified, then design routing, security and monitoring so the product scales without rework. Learn more about our web app development service.