Stop 20 · System DesignTopics · 8/15

API Gateway

In short

With ten microservices, should the mobile app know ten addresses and handle auth ten ways? No. An API gateway is one front door that checks, routes and protects every request.

In a system-design context: the single entry point in a microservices architecture that routes requests to the right internal service, and centralizes auth, rate limiting, and logging.

The purple blob as a society guard holds a clipboard and points the way past the gate barrier.

Think of it like this

The society main gate

Visitors to a housing society don't wander to any flat they like. The guard at the main gate checks who you are, calls the flat, notes the entry and points you to the right tower. Residents don't each need their own guard. An API gateway is that main gate.

Watch it happen

One front door, many services

Mobile app

API Gateway

Users svc

Orders svc

GET /orders (JWT)

1/7The app sends every request to one URL, with its access token.

The big ideas

What you need to know

One entry point

Clients use one domain. The gateway maps paths to services, so you can move or split services without breaking apps.

Shared checks, done once

Auth, rate limiting, CORS, size limits and logging happen at the edge instead of in every service.

Backend for frontend

Some teams run a separate gateway per client, like mobile and web, shaping responses for each.

Keep it thin

Keep business logic out of the gateway. It should route and protect, not calculate prices.

See it in code

Walk through the code

1import express from "express";2import { createProxyMiddleware } from "http-proxy-middleware";3import { verifyJwt, rateLimit } from "./edge";4 5const gw = express();6gw.use(rateLimit({ perMinute: 100 }));7gw.use(verifyJwt); // sets req.user or responds 4018 9gw.use("/orders", createProxyMiddleware({ target: "http://orders:4001", changeOrigin: true }));10gw.use("/users", createProxyMiddleware({ target: "http://users:4002", changeOrigin: true }));11 12gw.listen(8080);

1/3Every request is rate limited and authenticated once, before routing.

A teaching-sized gateway. In production teams often use managed gateways like AWS API Gateway, or tools like Kong or Envoy.

Save yourself the pain

Common mistakes

Oops

Putting business rules like discount logic in the gateway.

Do this instead

The gateway becomes a bottleneck that every team must change. Keep it to routing, auth and limits.

Oops

Leaving services reachable directly from the internet too.

Do this instead

Then attackers skip the gateway's checks. Keep services on a private network behind it.

Your mission

Build a mini gateway

~40 min

Quick check

Why verify JWTs in the gateway instead of in every service?

Go deeper

1Diagram how a client request flows through an API gateway to the correct microservice.
2Learn why an API gateway avoids exposing internal service topology directly to clients.
3Compare using a dedicated gateway product vs building simple routing logic yourself.