Stop 11 · Cloud Architecture PatternsTopics · 6/9

API Gateway Patterns

In short

Without a gateway, every service repeats the same chores: check tokens, limit abusive clients, log requests. An API gateway does those chores once, at the front door.

Using an API Gateway as a single entry point for routing, authentication, and rate limiting across multiple backend services — a common pattern for both serverless and microservices architectures.

The blob character stands behind a hotel reception desk with a service bell.

Think of it like this

The hotel reception

Guests don't wander the corridors looking for housekeeping. They go to reception, show their key card, and get pointed to the right place. Reception also stops anyone without a booking. A gateway is your API's reception desk.

Watch it happen

What the gateway does to one request

Client

Auth

Rate limit

Route

Service

1/5A mobile app sends GET /v1/orders/42 with a JWT in the Authorization header.

The big ideas

What you need to know

Single entry point

Clients use one domain. Behind it, routes map to functions, containers or old servers.

Cross-cutting chores

Authentication, rate limiting, CORS, request validation and logging live in one place.

Backend for frontend

Separate gateways or routes per client, like mobile and web, each shaped to that client's needs.

Options

Amazon API Gateway, Azure API Management, Google API Gateway and Apigee, or Kong and NGINX you run yourself.

See it in code

Walk through the code

http

1GET /v1/orders/42 HTTP/1.12Host: api.example.com3Authorization: Bearer eyJhbGciOiJSUzI1NiJ9...4 5HTTP/1.1 429 Too Many Requests6Retry-After: 307Content-Type: application/json8 9{"message": "Too Many Requests"}

1/3A normal authenticated request from a client that's been calling too often.

What a client sees when the gateway's rate limit kicks in. The backend never received this request.

Save yourself the pain

Common mistakes

Oops

Putting business logic, like discount calculations, in gateway scripts.

Do this instead

Keep the gateway thin: auth, routing, limits. Business rules belong in services.

Oops

Leaving backend services reachable directly from the internet, bypassing the gateway.

Do this instead

Make services private so the gateway is the only way in. Otherwise its checks are optional.

Your mission

Rate-limit your own API

~35 min

Quick check

Why validate JWTs at the gateway instead of in every service?

Go deeper

1Design an API Gateway configuration routing to multiple backend services.
2Learn how an API Gateway centralizes cross-cutting concerns (auth, logging, rate limiting) instead of duplicating them per service.
3Understand the trade-off: a gateway simplifies clients but becomes a critical, must-be-reliable component.