Stack Row

BlogBy Darlene Aberin7 min read

What Are API Gateways? Functions, Examples, and When You Need One

Engineer with a tablet beside a central gateway unit routing light trails between server racks

API gateways provide managed entry points between API clients and backend services. They receive requests, apply policies, route traffic, and return responses.

The gateway lets clients use a stable interface while backend systems change. It can also centralize authentication, throttling, logging, caching, and request transformation.

That role is expanding as APIs serve people, applications, and AI agents. Postman’s 2025 survey included more than 5,700 developers, architects, and executives. Only 24% said their teams actively designed APIs for AI agents.

Gateways do not fix unclear APIs or weak authorization. They provide a controlled enforcement point for policies that services would otherwise repeat.

How an API Gateway Works

A basic request follows five steps:

  1. A client sends a request to the gateway endpoint.
  2. The gateway validates identity, credentials, and policy requirements.
  3. It applies routing, rate limits, transformations, or caching rules.
  4. The gateway forwards the request to an appropriate backend service.
  5. It returns the response and records operational data.

Consider a mobile commerce application. The client requests one order summary from the gateway. The gateway calls order, payment, inventory, and shipping services. It can combine their results into one response.

This design reduces client complexity. It also prevents every backend service from becoming directly public.

Core API Gateway Functions

Most gateways combine several traffic and policy functions within one control point.

Request Routing

The gateway maps incoming paths, methods, headers, or hostnames to backend services. Routing lets teams change internal locations without changing every client.

Authentication and Authorization

A gateway can validate API keys, tokens, certificates, or identity-provider claims. Backend services should still enforce resource-level authorization where required.

Rate Limiting and Quotas

Rate limits control request volume by client, account, route, or period. They protect capacity and support commercial API plans.

Protocol and Payload Transformation

Gateways can change headers, paths, formats, or protocols. Transformations can preserve older clients during a backend migration.

Request Aggregation

One client call can trigger several backend calls. The gateway combines responses and reduces network round trips.

Caching

Response caching reduces repeated backend work for suitable requests. Teams must define freshness and invalidation rules carefully.

Observability

Gateways record request counts, latency, errors, identities, and routes. Those signals support troubleshooting, capacity planning, and security review.

API Gateway Example

Imagine a software company exposing three services:

  • GET /customers/{id} retrieves a customer record.
  • GET /orders/{id} retrieves an order.
  • POST /payments submits a payment.

Without a gateway, each service may expose a separate domain and security implementation. Clients must know every endpoint and handle each failure model.

With a gateway, clients call one domain. The gateway validates tokens, applies quotas, and routes requests. It can also block obsolete API versions after a migration window.

The gateway should not contain core business logic. Payment approval and order validation still belong inside their services.

API Gateway Versus Reverse Proxy

A reverse proxy receives client traffic and forwards it to servers. It commonly provides TLS termination, caching, and Layer 7 routing.

An API gateway is a specialized reverse proxy with API policy and management functions. Microsoft’s architecture guidance also identifies routing, aggregation, and offloading patterns.

NGINX can serve both roles with suitable configuration and products. Deployed capabilities define the role better than the software name.

API Gateway Versus Load Balancer

A load balancer distributes traffic across service instances. Its primary concern is availability and balanced utilization.

An API gateway routes requests across different APIs and applies client-facing policies. A gateway may include load balancing, but their responsibilities remain different.

Many systems use both. The gateway selects a service, while an internal load balancer selects a healthy instance.

API Gateway Versus Service Mesh

An API gateway usually manages north-south traffic between external clients and services. A service mesh usually manages east-west traffic between internal services.

Service meshes can provide mutual TLS, retries, traffic policies, and service telemetry. Gateways focus more on public interfaces, consumers, quotas, and API products.

The two can coexist. Small systems rarely need both at the beginning.

API Gateway Versus Kubernetes Gateway API

Kubernetes Gateway API is a resource model for configuring network traffic. It is not a complete API management product.

An implementation can provide routing through those resources. Consumer onboarding, API products, subscriptions, and analytics may require additional systems.

Container teams should also understand the operational choices behind Podman and Docker. A gateway does not replace container networking or workload orchestration.

Managed API Gateway Options

Managed and self-hosted products package these functions differently.

Amazon API Gateway

Amazon API Gateway supports REST, HTTP, and WebSocket APIs. It integrates with Lambda, HTTP services, and other AWS services.

AWS charges for calls and data transfer, with API type affecting price. The platform includes throttling, monitoring, caching, access control, and version management.

Azure API Management

Azure API Management combines a gateway, management plane, and developer-facing capabilities. Its gateway supports routing, security, throttling, caching, and observability.

Azure also offers a self-hosted gateway for hybrid and multicloud environments. Tiers differ significantly, so architecture should precede pricing comparisons.

Google Cloud API Gateway

Google Cloud API Gateway provides managed access to backend services through consistent REST APIs. It uses API configurations for management, authentication, and monitoring.

The first two million monthly calls are free per billing account. Google’s pricing page lists $3 per million calls after that, up to one billion calls.

Kong Gateway

Kong Gateway supports proxying, TLS, authentication, rate limiting, transformations, logging, and monitoring. It offers flexible deployment models, including hybrid arrangements.

Kong can suit teams needing plugin extensibility or deployment control. Operations effort depends on the selected edition and hosting model.

When You Need an API Gateway

An API gateway becomes useful when several conditions appear together:

  • Multiple services expose APIs to external or partner clients.
  • Authentication and rate policies need consistent enforcement.
  • Clients require a stable interface across backend changes.
  • Teams need centralized traffic analytics and audit data.
  • One client operation calls several services.
  • Different consumers need versions, quotas, or transformations.
  • Public backends should remain hidden from direct access.

A gateway also fits an IaaS or PaaS architecture where managed policy enforcement reduces custom infrastructure.

When You May Not Need One

A single private service may not justify another network hop. The application framework may already provide authentication, routing, and observability.

A gateway also adds failure modes, configuration, cost, and operational ownership. Centralization can create a bottleneck when every change requires one platform team.

Start with a specific policy problem. Do not add a gateway only because the architecture uses microservices.

API Gateway Risks and Controls

Centralized traffic management creates risks that teams should address during design.

Single Point of Failure

Deploy gateways across failure domains. Test failover, capacity, and configuration rollback.

Excessive Policy Logic

Keep business rules inside services. Use the gateway for cross-cutting traffic policies.

Authorization Gaps

Gateway authentication does not prove access to every resource. Services should enforce object and tenant permissions.

Hidden Latency

Measure added processing and aggregation time. Trace requests across the gateway and every backend.

Configuration Drift

Manage routes and policies as reviewed, versioned configuration. Separate development, test, and production environments.

API Gateway Selection Checklist

Evaluate products against real traffic and governance needs:

  • Required protocols and API styles
  • Peak requests and latency targets
  • Identity and authorization integration
  • Rate-limit precision and storage behavior
  • Deployment regions and availability design
  • Hybrid or on-premises requirements
  • Logging, metrics, and distributed tracing
  • OpenAPI import and policy automation
  • Developer portal and subscription needs
  • Pricing at expected and stress volumes
  • Exit options and configuration portability

Run a load test with real policies enabled. Empty proxy benchmarks understate authentication, logging, and transformation costs.

Frequently Asked Questions

Is an API Gateway a Reverse Proxy?

Yes, an API gateway performs reverse proxy functions. It adds API-focused security, policy, analytics, and consumer management capabilities.

Does Every Microservice Architecture Need an API Gateway?

No. A gateway becomes useful when clients need centralized routing, policies, aggregation, or stable interfaces.

Can an API Gateway Replace a Load Balancer?

Some gateways include load balancing. Large systems often keep separate gateway and internal load-balancing layers.

Does an API Gateway Improve Security?

It centralizes controls and reduces direct backend exposure. Secure services still require authorization, validation, patching, and network controls.

Are API Gateways Useful for AI Agents?

They can authenticate agents, restrict tools, apply quotas, and record activity. Agent authorization and prompt-related controls still need separate design.

Resources

Related Reading