Stop 08 · Serverless & Event-Driven ArchitectureTopics · 3/9

API Gateway

In short

With ten microservices, should the mobile app know ten addresses and handle auth ten ways? No. An API gateway is one front door that checks, routes and protects every request.

A managed service that sits in front of your backend (often serverless functions) to handle routing, authentication, rate limiting, and request/response transformation for HTTP APIs.

The purple blob as a society guard holds a clipboard and points the way past the gate barrier.

Think of it like this

The society main gate

Visitors to a housing society don't wander to any flat they like. The guard at the main gate checks who you are, calls the flat, notes the entry and points you to the right tower. Residents don't each need their own guard. An API gateway is that main gate.

Watch it happen

One front door, many services

Mobile app

API Gateway

Users svc

Orders svc

GET /orders (JWT)

1/7The app sends every request to one URL, with its access token.

The big ideas

What you need to know

One entry point

Clients use one domain. The gateway maps paths to services, so you can move or split services without breaking apps.

Shared checks, done once

Auth, rate limiting, CORS, size limits and logging happen at the edge instead of in every service.

Backend for frontend

Some teams run a separate gateway per client, like mobile and web, shaping responses for each.

Keep it thin

Keep business logic out of the gateway. It should route and protect, not calculate prices.

See it in code

Walk through the code

1import express from "express";2import { createProxyMiddleware } from "http-proxy-middleware";3import { verifyJwt, rateLimit } from "./edge";4 5const gw = express();6gw.use(rateLimit({ perMinute: 100 }));7gw.use(verifyJwt); // sets req.user or responds 4018 9gw.use("/orders", createProxyMiddleware({ target: "http://orders:4001", changeOrigin: true }));10gw.use("/users", createProxyMiddleware({ target: "http://users:4002", changeOrigin: true }));11 12gw.listen(8080);

1/3Every request is rate limited and authenticated once, before routing.

A teaching-sized gateway. In production teams often use managed gateways like AWS API Gateway, or tools like Kong or Envoy.

Save yourself the pain

Common mistakes

Oops

Putting business rules like discount logic in the gateway.

Do this instead

The gateway becomes a bottleneck that every team must change. Keep it to routing, auth and limits.

Oops

Leaving services reachable directly from the internet too.

Do this instead

Then attackers skip the gateway's checks. Keep services on a private network behind it.

Your mission

Build a mini gateway

~40 min

Quick check

Why verify JWTs in the gateway instead of in every service?

Go deeper

1Set up an API Gateway routing a request to a serverless function.
2Configure basic rate limiting or throttling on an API Gateway endpoint.
3Learn why API Gateway is the standard front door for a serverless application's APIs.