MicroservicePatterns.com
Communication · Foundation

API Gateway

The API Gateway pattern puts a single entry point in front of a set of microservices to handle routing, authentication, rate limiting and other concerns for every client request.

Last updated

What is the API Gateway pattern?

A gateway sits between clients and services. It routes requests, terminates TLS, authenticates callers, applies rate limits, translates protocols and can aggregate simple responses. A Backend for Frontend (BFF) is a gateway built for one client type, such as mobile or web.

What problem does the API Gateway pattern solve?

Without a gateway, every client must know every service address, repeat authentication logic and make many round trips. A gateway puts those concerns in one place and hides how the system is split up.

How do you implement the API Gateway pattern?

  1. Define the public API for each type of client.
  2. Route each public path to the service that owns it.
  3. Handle cross-cutting concerns here: authentication, rate limits, request IDs and logging.
  4. Aggregate only simple composites. Keep business logic in the services.
  5. Run several instances, set timeouts and breakers on upstream calls, and monitor it as a critical component.

When should you use it?

  • You expose many services to external clients.
  • Different clients need different shapes of the same data.

When should you avoid it?

  • There is only one service and one client.
  • You are tempted to put business rules in it, which makes the gateway the new monolith.

What do you gain?

  • One place for security and policy
  • Hides internal topology
  • Fewer client round trips

What does it cost?

  • Extra network hop
  • A potential bottleneck and single point of failure
  • Needs an owner, or it grows into a dumping ground

What are common mistakes with the API Gateway pattern?

  • Business logic in the gateway.
  • One central team that every change must go through.
  • No timeouts or breakers on calls to upstream services.

API Gateway in practice

Real-world example

Netflix

TVs, phones, game consoles and browsers all needed to reach the same streaming backend, each with its own network conditions and request patterns.

Netflix built Zuul as the front door for every request from devices and web sites to the streaming backend, handling dynamic routing, monitoring, resiliency and security in one place. Its wiki says it has taken all Netflix API traffic since May 2012.

Source: Zuul wiki (Netflix, GitHub)

Example decision record
Context
Clients call internal services directly, and each service implements its own authentication and TLS.
Decision
Make an API gateway the only public entry point to the services.
Consequences
  • Internal services can live in private networks.
  • Authentication, TLS and rate limiting are applied in one place, and the gateway becomes critical infrastructure.