← System Design
API Gateway
Traffic ManagementA single entry point that handles cross-cutting concerns (auth, rate limiting, routing) before requests reach backend services.
An API Gateway sits in front of a set of backend/microservices and provides one unified entry point for clients. It centralizes cross-cutting concerns that would otherwise be duplicated in every service: authentication/authorization, rate limiting, request routing/composition, protocol translation (e.g. REST-to-gRPC), request/response transformation, and observability (centralized logging/metrics).
How it connects
API Gateway as the source, with the components it typically interacts with.
- → Load Balancer: The gateway is usually placed behind (or paired with) a load balancer so gateway instances themselves can scale horizontally.
- → Rate Limiting: Rate limiting is one of the gateway's core cross-cutting responsibilities, enforced once per request before it reaches any backend service.
- → Service Discovery: The gateway looks up healthy service instances via service discovery to route each request to the correct, live backend.
- → Authentication & Authorization (OAuth2/JWT/SSO): The gateway is the natural place to terminate authentication (validate JWTs/API keys) once, instead of duplicating it in every microservice.
- → Circuit Breaker & Bulkhead: The gateway wraps calls to downstream services with a circuit breaker so one failing service can't cascade failures back to all clients.