API Gateway Architecture

How an API gateway routes, authenticates, and rate-limits client requests to backend services

CLIENTS Web App browser Mobile App iOS · Android 3rd-Party API partner · webhook API GATEWAY Auth / JWT Verify Bearer token · API key Rate Limiter 1000 req / min Request Router /users → svc-a Load Balancer round-robin Response Cache TTL 60s · Redis Logging / Tracing OpenTelemetry MICROSERVICES User Service :8001 · /users Order Service :8002 · /orders Payment Service :8003 · /payments Notification Svc :8004 · async DATA LAYER Users DB PostgreSQL Orders DB PostgreSQL Redis Cache :6379 Message Queue Kafka · async events 1 2 3 4 429 REJECT HTTP ROUTE Legend Client request Rejected (429) Routed request Data access

What it does

Single Entry Point

  • Auth before any service sees the request
  • Rate limiting protects all services
  • One URL for all clients

Key Benefits

Cross-Cutting Concerns

  • No auth logic in each service
  • Centralized logging + tracing
  • Cache at gateway layer

Trade-offs

Single Point of Failure

  • Must be highly available
  • Can become bottleneck
  • Adds ~1–5ms latency