Cloud Parts

API gateways

The front door for your APIs: auth, limits and routing in one place.

2 technologies on this page ↓
Live model
What you’re watchingCalls from three clients pass through the gateway. Some are rejected for bad credentials or rate limits; the rest are routed by path to the right service.

How it works

An API gateway sits in front of backend services and handles what every API needs: authenticating callers with API keys, JWTs or OAuth, rate limits and quotas, request validation, routing paths to the right service, and usage metrics. The services behind it can focus on business logic.

Think of it as

Building reception. They check your badge, sign you in, cap how many visitors each company gets, and tell you which floor to go to.

Reach for it when

  • Public or partner APIs that need keys, quotas and usage plans
  • One entry point in front of many microservices or functions
  • Consistent auth and throttling without rebuilding it in every service

Think twice when

  • High-volume internal service-to-service calls, where it adds latency and cost
  • Serving static files; that’s a CDN’s job

A real example

A partner integration gets an API key limited to 100 requests per second. The gateway rejects bad tokens with 401 and excess traffic with 429, and routes /orders/* and /users/* to separate services.

Technologies

Specific products, and what each does differently.

What each provider calls it

AWS
API Gateway
Google Cloud
Apigee, API Gateway
Azure
API Management
Open source & others
Kong, Tyk, Envoy Gateway

See it in a real stack

Architectures that use api gateways

Serverless web app on AWSCloudFront serves the site from S3 and sends API calls through API Gateway to Lambda functions backed by DynamoDB.Amazon CloudFrontAmazon S3Amazon API GatewayAWS LambdaAmazon DynamoDBCQRS with a static read sideCommands update PostgreSQL; a Lambda projector rewrites the affected JSON views in S3, and CloudFront serves every read without touching a database.Amazon API GatewayAWS LambdaPostgreSQLAmazon SQSAmazon S3Amazon CloudFrontCode sandboxes for AI agentsAn agent’s code runs in a fresh Firecracker microVM per task, isolated by its own kernel, with outputs saved to S3.FirecrackerAmazon S3

In code · yaml

# Kong declarative config
services:
  - name: orders
    url: http://orders.internal:8080
    routes: [{ paths: ["/orders"] }]
    plugins:
      - name: key-auth
      - name: rate-limiting
        config: { second: 100 }

Often confused with

Load balancersServerless functions (FaaS)Identity & access (IAM)AuthenticationService discovery & meshRemote procedure callsWeb APIsMicroservicesServerless architectureLoad balancer, API gateway or CDN?
Where it came from2005–2023

The idea started in the service-oriented architecture era of the early 2000s, when companies connected systems with XML web services. Rack-mounted XML appliances, such as DataPower’s (bought by IBM in 2005), sat in front of those services to secure and speed up the traffic. As public web APIs spread for mobile apps and partners, every API needed the same chores: keys, quotas, security and usage analytics. Sonoa Systems, which began with a router-like XML appliance, released Apigee in 2009 as a cloud tool for exactly that, and renamed itself after it in 2010.

Microservices made the gateway the front door to a whole system. Netflix built an edge service, Zuul, to sit between its devices and its backend services, and announced it as open source in 2013. Chris Richardson’s microservices pattern describes the result: an API gateway is “the single entry point for all clients”, which either routes a request to one service or fans it out to several.

Then gateways became products anyone could rent or download. AWS launched API Gateway in 2015, with Lambda as its headline backend; Mashape open-sourced the gateway it had built for its own API marketplace as Kong the same year; and Google bought Apigee in 2016 for $625 million.

Why it’s built this way

Take cross-cutting chores out of every service
Authentication, rate limits and logging are the same for every API. Doing them once at the edge keeps that code out of each service and makes the rules consistent.
A single entry point that can fan out
Mobile networks are much slower and higher-latency than a data center LAN, so a screen that needs many backend calls feels sluggish. A gateway on the fast side can make those calls and return one combined reply.
A gateway per kind of client
Web, mobile and partner clients want differently shaped APIs. The “backends for frontends” variation gives each its own gateway, as Netflix did with client-specific adapter code.

Timeline

  1. 2005

    IBM buys DataPower, maker of XML gateway appliances for SOA

  2. 2009

    Sonoa Systems releases Apigee, a cloud API management tool

  3. 2013

    Netflix announces Zuul, its edge gateway, as open source

  4. 2015

    Amazon API Gateway launches; Mashape open-sources Kong

  5. 2016

    Google acquires Apigee for $625 million

  6. 2023

    Kubernetes Gateway API reaches v1.0, a standard way to configure gateways

Sources13

Improve this page on GitHub