Understanding API Gateway Fundamentals
1. Understanding Gateway Architecture
An API Gateway is a reverse proxy that sits between clients and backend services, providing a single entry point for all API requests.
| Component | Role | Examples |
|---|
| Edge Layer | TLS termination, request acceptance | Envoy, NGINX |
| Routing Engine | Matches paths to upstream services | Kong, Tyk |
| Policy Engine | Auth, rate limit, transformation | OPA, Wasm filters |
| Upstream Pool | Backend service registry | Consul, Eureka |
| Observability | Metrics, traces, logs | Prometheus, OTel |
| Control Plane | Config distribution, admin | Istiod, Konnect |
Client → [Edge/TLS] → [Auth] → [Rate Limit] → [Router]
↓
[Transform] → [Upstream Pool]
↓
Service A / B / C
2. Understanding Gateway vs Load Balancer
| Feature | API Gateway | Load Balancer |
|---|
| OSI Layer | L7 (HTTP/gRPC) | L4 (TCP/UDP) or L7 |
| Routing basis | Path, header, body, claims | IP/port, host header |
| Auth/AuthZ | Yes (JWT, OAuth, mTLS) | No (passthrough) |
| Transformation | Headers, body, protocol | None |
| Rate limiting | Per-user, per-key, per-route | Connection limits only |
| Examples | Kong, AWS API GW, Apigee | HAProxy, AWS ALB/NLB |
3. Understanding Gateway Types
| Type | Use Case | Examples |
|---|
| Edge Gateway | Public-facing, north-south traffic | Kong, AWS API Gateway |
| Internal/API Gateway | Service-to-service composition | Spring Cloud Gateway |
| Service Mesh Gateway | East-west traffic, sidecar pattern | Istio Gateway, Linkerd |
| BFF Gateway | Per-frontend (web, mobile) | Custom Node/Go |
| Micro Gateway | Lightweight, embedded | Tyk MDCB, Kong DP |
| Managed/Serverless | Pay-per-call, zero ops | AWS APIGW, Azure APIM |
4. Understanding Request-Response Flow
Request Lifecycle
- TLS handshake and HTTP parse
- Pre-routing filters (CORS, IP allowlist)
- Route matching (path, method, host)
- Authentication (JWT, API key)
- Authorization (RBAC, scopes)
- Rate limiting and quota check
- Request transformation (headers, body)
- Upstream selection (load balance)
- Proxy to backend with retry/timeout
- Response transformation and logging
5. Understanding Synchronous vs Asynchronous Patterns
| Pattern | Behavior | When to Use |
|---|
| Sync HTTP | Block until backend responds | CRUD, queries |
| Async Webhook | 202 Accepted, callback later | Long jobs, exports |
| SSE | Server pushes events | Live updates, logs |
| WebSocket | Bidirectional persistent | Chat, trading |
| gRPC Streaming | Client/server/bidi streams | Telemetry, IoT |
| Queue-backed | Gateway → MQ → worker | Spiky workloads |
6. Understanding Gateway Deployment Models
| Model | Description | Trade-offs |
|---|
| Centralized | Single shared gateway cluster | Simple ops, bottleneck risk |
| Distributed | Multiple gateways per domain | Isolation, more ops |
| Sidecar | Gateway per pod (mesh) | Fine control, overhead |
| Hybrid | Edge + internal mesh | Best of both, complex |
| Serverless | Managed by cloud | Zero ops, cold starts |
7. Understanding Gateway Benefits
| Benefit | Detail |
|---|
| Single entry point | Unified URL, simplifies clients |
| Cross-cutting concerns | Auth, logging, rate limit in one place |
| Protocol translation | REST↔gRPC, SOAP↔REST |
| Service decoupling | Clients don't know backend topology |
| Versioning | Multiple API versions side-by-side |
| Security boundary | WAF, DDoS protection at edge |
8. Understanding Common Use Cases
| Use Case | Pattern |
|---|
| Microservices facade | Aggregate many services into one API |
| BFF (Backend for Frontend) | Tailored API per client type |
| Legacy modernization | Wrap SOAP/XML with REST/JSON |
| Partner/public APIs | Monetize via keys, quotas |
| Multi-region failover | DNS + gateway health routing |
| Zero-trust ingress | mTLS, JWT, policy enforcement |
9. Understanding Gateway Limitations
| Limitation | Mitigation |
|---|
| Single point of failure | HA pairs, multi-AZ, anycast |
| Added latency (1-10ms) | Edge deploy, connection pooling |
| Config sprawl | GitOps, declarative configs |
| Vendor lock-in | OpenAPI, portable plugins |
| Debugging complexity | Distributed tracing, correlation IDs |
| Cost at scale | Self-host vs managed analysis |
| Metric | Target | Lever |
|---|
| p50 latency overhead | < 2ms | Async I/O, no-copy proxy |
| p99 latency | < 20ms | Connection reuse, warm pools |
| Throughput | 10k+ RPS per core | Envoy/NGINX worker model |
| Concurrent conns | 50k+ per node | epoll, ulimit tuning |
| CPU per request | < 100µs | Compiled filters (Wasm/Rust) |
| Memory per conn | < 8KB | Buffer pooling |