Implementing API Gateway
1. Routing Requests
| Routing By | Example |
|---|---|
| Path | /orders/* → order-service |
| Host | api.shop.com → shop-stack |
| Header | X-Tenant: acme → tenant cluster |
| Method | GET → cache-tier; POST → app-tier |
| Weighted | 90% v1 / 10% v2 (canary) |
2. Implementing Request Aggregation
| Pattern | Detail |
|---|---|
| Scatter-gather | One client call → fan-out to N services → merge |
| BFF aggregation | Per-client tailored composite endpoint |
| GraphQL gateway | Federation handles aggregation declaratively |
| Caveat | Bound concurrent fan-out; respect deadlines |
3. Handling Protocol Translation
| External | Internal |
|---|---|
| REST/JSON | gRPC |
| GraphQL | REST + gRPC |
| WebSocket / SSE | Kafka / NATS subscribe |
| SOAP LEGACY | REST |
4. Implementing Rate Limiting
| Scope | Key |
|---|---|
| Per-IP | X-Forwarded-For |
| Per-user | JWT subject |
| Per-API key | Header |
| Global | Protect upstream |
| Algorithm | Token bucket / sliding window |
5. Managing Authentication
| Step | Detail |
|---|---|
| Verify token | JWT signature, expiry, issuer |
| Strip / re-issue | Replace external JWT with internal one |
| Inject claims | X-User-ID, X-Roles |
| mTLS upstream | Encrypt and authenticate to services |
6. Implementing Request/Response Transformation
| Transformation | Example |
|---|---|
| Add header | Inject correlation ID |
| Rewrite path | /v1/users → /users |
| Body transform | JSON → XML, snake_case ↔ camelCase |
| Filter fields | Strip internal fields from responses |
7. Handling API Versioning
| Strategy | Routing Rule |
|---|---|
| Path | /v1/* → v1 cluster |
| Header | Accept: application/vnd.shop.v2+json |
| Subdomain | v2.api.shop.com |
| Default | Pin to latest stable; deprecate old via headers |
8. Implementing Response Caching
| Layer | TTL |
|---|---|
| Edge cache | Seconds–minutes for hot reads |
| Honor headers | Cache-Control, ETag, Vary |
| Bypass | Cookies, auth, mutating methods |
| Invalidation | On write events; surrogate keys (Fastly/Varnish) |
9. Using Circuit Breakers
| Setting | Detail |
|---|---|
| Error threshold | 50% over rolling window |
| Open duration | 30s; then half-open probe |
| Fallback | Cached response or 503 |
| Per-route | Don't trip whole gateway |
10. Implementing CORS Handling
| Header | Use |
|---|---|
| Access-Control-Allow-Origin | Allowed origins (no * with credentials) |
| Access-Control-Allow-Methods | GET, POST, PUT, DELETE, PATCH |
| Access-Control-Allow-Headers | Authorization, Content-Type, ... |
| Access-Control-Allow-Credentials | true for cookies |
| Access-Control-Max-Age | Preflight cache (e.g. 86400) |
11. Managing API Documentation
| Tool | Detail |
|---|---|
| OpenAPI 3.1 | JSON/YAML spec; aggregate per gateway |
| Swagger UI / Redoc | Interactive docs |
| AsyncAPI | Document async/event APIs |
| Backstage | Catalog of all service APIs |
| Spectral | Lint OpenAPI for consistency |
12. Implementing Backend for Frontends
| BFF | Tailored For |
|---|---|
| web-bff | Browser; aggregates many services |
| mobile-bff | Smaller payloads, offline support |
| partner-bff | External integrations, stricter auth |
| Owned by | Frontend team (loose coupling to backend) |
[Web] → [web-bff] ─┐
[Mobile]→ [mobile-bff]─┼─► [orders] [users] [payments]
[B2B] → [partner-bff]┘