API Gateway

An API gateway is a single entry point for all client requests, routing them to appropriate backend services.

API Gateway Architecture

                    ┌─────────────────┐
                    │   API Gateway   │
                    │                 │
Client ──────────→ │  • Routing      │
                    │  • Auth         │
                    │  • Rate Limiting│
                    │  • Transformation│
                    └────────┬────────┘
                             │
              ┌──────────────┼──────────────┐
              │              │              │
       ┌──────▼──┐    ┌──────▼──┐    ┌──────▼──┐
       │ User Svc│    │Order Svc│    │ Pay Svc │
       └─────────┘    └─────────┘    └─────────┘

API Gateway Functions

Function	Description
Routing	Direct requests to correct service
Authentication	Verify user identity
Authorization	Check permissions
Rate Limiting	Prevent abuse
Load Balancing	Distribute across instances
SSL Termination	Handle HTTPS
Request Transformation	Modify requests/responses
Caching	Cache responses
Logging	Centralized request logging
API Versioning	Route to correct version

API Gateway vs Reverse Proxy

Aspect	API Gateway	Reverse Proxy
Intelligence	Request routing, auth	Basic forwarding
Protocol	HTTP/HTTPS	HTTP
Features	Rate limiting, transformation	Caching, compression
Use case	Microservices	Web applications

Popular API Gateways

- Kong (Open Source)
- AWS API Gateway
- Apigee (Google)
- Azure API Management
- Envoy (High performance)
- Traefik (Cloud-native)

API gateway routes requests to appropriate backend services based on rules.

Routing Rules

# Kong routing example
services:
  - name: user-service
    url: http://user-service:8080
    routes:
      - paths: ["/api/users"]
        methods: ["GET", "POST"]

  - name: order-service
    url: http://order-service:8080
    routes:
      - paths: ["/api/orders"]
        methods: ["GET", "POST", "PUT"]

  - name: payment-service
    url: http://payment-service:8080
    routes:
      - paths: ["/api/payments"]
        methods: ["POST"]

Routing Types

Type	Description	Example
Path-based	Route by URL path	/users → User Service
Method-based	Route by HTTP method	POST /users → Create
Header-based	Route by header value	X-Version: v2
Query-based	Route by query params	?type=premium

Service Composition

# API Gateway can compose multiple services
GET /api/users/123/orders

Gateway:
1. Get user from User Service
2. Get orders from Order Service
3. Combine and return

Client sees single API, gateway handles composition

Route Configuration

# Envoy routing example
routes:
  - match:
      prefix: /api/users
    route:
      cluster: user_service
      timeout: 30s
      retry_policy:
        retry_on: 5xx
        num_retries: 3

  - match:
      prefix: /api/orders
    route:
      cluster: order_service

Routing Best Practices

1. Consistent naming: /api/{service}/{resource}
2. Version in path: /api/v1/users
3. Timeout configuration: Set appropriate timeouts
4. Retry policy: Configure retries for failures
5. Circuit breaker: Prevent cascading failures

API gateways handle security and abuse prevention.

Rate Limiting

Rate Limiting Strategies:

1. Fixed Window
   - Limit: 100 requests per minute
   - Counter resets every minute
   - Problem: Burst at window boundary

2. Sliding Window
   - Limit: 100 requests per minute
   - Window slides with each request
   - Smoother distribution

3. Token Bucket
   - Bucket fills with tokens
   - Each request consumes a token
   - Allows bursts up to bucket size

4. Leaky Bucket
   - Requests queued
   - Processed at fixed rate
   - Smooths out bursts

Rate Limiting Configuration

# Kong rate limiting
plugins:
  - name: rate-limiting
    config:
      minute: 100
      hour: 1000
      policy: redis
      redis_host: redis.example.com
      fault_tolerant: true
      hide_client_headers: false

Rate Limit Response

HTTP/1.1 429 Too Many Requests
Content-Type: application/json
Retry-After: 60
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1640995200

{
  "error": "Rate limit exceeded",
  "message": "Try again in 60 seconds"
}

Authentication at Gateway

Authentication Flow:

1. Client sends request with token
   Authorization: Bearer eyJhbG...

2. Gateway validates token
   - Check signature
   - Check expiration
   - Extract user info

3. Gateway adds user context
   X-User-ID: 123
   X-User-Role: admin

4. Backend receives enriched request

JWT Validation

# Kong JWT validation
plugins:
  - name: jwt
    config:
      claims_to_verify:
        - exp
      key_claim_name: iss
      secret_is_base64: false

OAuth 2.0 Integration

1. Client → Gateway → Auth Server (get token)
2. Client → Gateway (with token)
3. Gateway validates token
4. Gateway → Backend (with user info)

Security Best Practices

1. Validate at gateway: Don't trust backend validation
2. Use HTTPS everywhere: TLS termination at gateway
3. Implement rate limiting: Prevent abuse
4. Log security events: Monitor for attacks
5. Rotate secrets: Regular key rotation