What is an API Gateway?

An Application Programming Interface (API) Gateway is a service that sits between a client and one or more backend services, and provides a single and consistent entry point for the requests sent to these services, regardless of their architecture.

Technically speaking, it acts as a reverse proxy server responsible for:

• Handling incoming API calls.
• Directing them to the appropriate backend services.
• Aggregating their results into a single entity.
• Sending it as a unique response back to the client.

Benefits of API gateways

Flexibility

By acting as the single communication interface between the clients and the backend services, the API Gateway allows developers to continuously change and improve a system’s architecture without impacting the way clients interact with the application.

Security

By acting as an intermediary between the clients and the backend services, it allows to hide the identity (i.e. IP address and port) of these services, as well as the technology they use, thus improving the level of defense against security attacks.

It also allows to control the access to protected resources through methods such as Authentication and Authorization.

Finally, it helps improving the overall security of the application by encrypting the communication with the clients through the use of the HTTPS protocol, enforced by SSL/TLS certificates.

Load balancing

It allows to efficiently balance the load between the available nodes to ensures that the application remains available, even during high traffic spikes, using algorithms such as Round Robin or Least Connections.

Rate limiting and throttling

It allows to limit the number of API calls a client can make in a specific period of time (e.g. per second, per day, etc.) using techniques such as Rate Limiting and Throttling.

Caching

It can help optimize API calls by Caching frequently requested data in order to avoid unnecessary load on backend services, which ultimately improves performance while decreasing cost.

Monitoring

It allows to monitor API calls by generating traffic logs that can help developers gain insights on their API usage, and fix eventual infrastructure problems.

Validation

It allows to validate the data contained in incoming requests before it is forwarded to the different backend services. This way, if something is missing or badly formatted, the gateway can reject the request early on, thus avoiding unnecessary processing.

Challenges of API gateways

Complexity

By introducing an API gateway into an existing architecture, the complexity of the communication between services automatically increases, as the routing logic will need to be rewritten in order to allow this component to dispatch incoming requests and aggregate responses.

Reliability

Since it acts as the main entry point for API calls, the entire application would become unavailable if it were to go down. However, this problem can be mitigated by having multiple instances of the API gateway managed by a load balancer.

Scaling

In the context of microservices, it has to be able to dynamically keep track of each service instances as they are added, updated or removed. One way to solve this is to use the Service Discovery pattern.