What the API Gateway Does

The Single Entry Point

An API Gateway is a single entry point for all client requests in a microservices architecture. Rather than exposing dozens of internal services directly to clients, you expose one gateway that routes, authenticates, and enriches requests.

Five core functions:

• Request routing — Maps incoming URL paths to the correct backend service.
• Authentication and authorization — Validates tokens before requests reach any backend. Centralizes security.
• Rate limiting — Enforces per-client or per-endpoint limits. Prevents abuse.
• SSL termination — Handles HTTPS at the edge; internal services communicate over plain HTTP.
• Request/response transformation — Adds, removes, or rewrites headers; aggregates multiple service responses into one.

Two Main Patterns

Unified Gateway — One gateway handles all clients. Simple to start; can become a complex monolith if the gateway accumulates too much logic.

Backend for Frontend (BFF) — A dedicated gateway per client type (mobile, web, third-party). Each BFF provides a lean, purpose-built API. Higher operational cost, but better isolation and performance per client.