NexisyTech Learningby Nexisy Technologies

API Gateway

A single front door that routes, secures and shapes traffic to your back-end services.

Intermediate8 min read3 interview questions

An API gateway sits between clients and services. Clients call one address; the gateway decides which service handles the request and applies shared policies on the way.

It keeps cross-cutting concerns — authentication, rate limits, logging, TLS — out of every individual service.

Diagram

/users/orders/payWeb appMobile appAPI gatewayauth · limits · routingUser serviceOrder servicePayment service
Clients talk to one gateway, which routes each path to the right service.

How it works

  1. Terminate TLS and validate the request format.
  2. Authenticate the caller (validate the JWT or API key).
  3. Apply rate limits and quotas for the client or tenant.
  4. Route to the right service and version; transform headers if needed.
  5. Optionally aggregate several service calls into one response.
  6. Log the call, emit metrics and add a correlation ID.

Key concepts

Reverse proxy
Forwards client requests to back-end servers. A gateway is a reverse proxy with API-specific features.
Backend for frontend (BFF)
A gateway per client type (web, mobile) shaped to that client’s needs.
Request aggregation
The gateway calls several services and combines results, saving client round trips.
Examples
Azure API Management, AWS API Gateway, Kong, YARP, NGINX, Envoy.

Trade-offs

Benefits

  • One entry point and one place for security policies
  • Services can move or split without clients noticing
  • Central metrics and rate limiting

Costs

  • Another hop and potential bottleneck
  • Must be highly available
  • Can turn into a dumping ground for business logic

Use it when

  • Several back-end services behind one public API
  • Different client types needing different shapes of data

Common mistakes

  • Putting business rules in the gateway
  • Services trusting any request without verifying it came through the gateway
  • One shared gateway team becoming a release bottleneck

Interview questions

Q1What is the difference between a load balancer and an API gateway?
A load balancer spreads traffic across instances of the same service. A gateway routes requests to different services and applies API policies like auth and rate limits. They are often used together.
Q2Should services still validate tokens behind a gateway?
Yes, at least authorization. Defence in depth means a service should not assume every caller is trusted just because it is on the internal network.
Q3What is the BFF pattern?
A separate back end for each front end (web, iOS, Android), owned by that front-end team, that aggregates and shapes data for its screens.

Related lessons

Scalability & Performance

Load Balancing

Spread traffic across healthy servers so no single machine becomes the bottleneck.

Beginner8 min read Scalability & Performance

Rate Limiting

Cap how many requests a client can make so one caller can’t overwhelm everyone else.

Intermediate8 min read Messaging & Microservices

Microservices Design Patterns

Decomposition, integration, data, resilience and deployment patterns for service-based systems.

Advanced12 min read