What an API gateway does

An API gateway is a reverse proxy that sits in front of your services and handles cross-cutting concerns: authentication, rate limiting, SSL termination, routing, request/response transformation, and logging.

Core responsibilities

  • Authentication — validate JWTs or API keys once at the gateway. Services receive a pre-authenticated request.
  • Rate limiting — enforce per-client limits without touching service code.
  • Routing — /v1/orders/* → orders-service, /v1/users/* → user-service.
  • Request aggregation — the BFF (Backend for Frontend) pattern: the gateway calls multiple services and assembles a single response for the client.

Options

  • Kong — open-source, plugin ecosystem, Kubernetes-native.
  • AWS API Gateway — fully managed, deep AWS integration, pay per request.
  • nginx / Caddy — lightweight, config-based, no management overhead for simple cases.
  • Traefik — dynamic config from Docker/K8s labels, great for container environments.

When not to use a gateway

A monolith or two-service architecture does not need a gateway. The added latency hop and operational complexity is not worth it until you have multiple services with shared cross-cutting concerns.