What is an API Gateway?

What is an API Gateway?

An API gateway is a service that acts as the entry point for API requests. It receives a request from a client, sends it to the application service that should handle it, and returns that service’s response.

For example, a ride-sharing app can send its API requests to one gateway. The gateway can route a request for nearby drivers to the Driver Location service, a ride request to the Ride service, or a fare payment to the Payment service.

What does it do?

The gateway can route requests to different services using details such as the request path. For example, /drivers/nearby could go to Driver Location, while /rides could go to the Ride service.

Depending on its software and configuration, an API gateway may also check authentication, apply rate limits, validate or transform requests, handle HTTPS, and record traffic. These are optional capabilities, not requirements for every gateway.

To a client, the gateway provides a single API entry point. Behind it, different services can handle different parts of the application.

At which network layer does it work?

An API gateway usually works at Layer 7, the application layer. It understands API request details such as the HTTP method, URL path, and headers, and can use them to choose a service.

For example, it can route GET /drivers/nearby to Driver Location and POST /rides to the Ride service. A Layer 4 load balancer works with network and transport details such as IP addresses, ports, and TCP or UDP connections; it does not need to understand HTTP paths.

Some products support additional protocols or lower-layer traffic, but API routing based on HTTP details is a Layer 7 function.

How is it different from a proxy and a load balancer?

These terms describe different roles, although one piece of software can perform more than one role.

An API gateway usually acts as a reverse proxy, because it receives requests on behalf of backend services. It may also use load balancing when a destination service has multiple instances. The key distinction is that a load balancer chooses among servers, while an API gateway can route between different services.

Well-known API gateways

Some gateways are provided as managed cloud services; others are software you run and configure yourself. Examples include:

• Amazon API Gateway: a managed AWS service for defining API routes and connecting them to backend integrations.
• Azure API Management: a managed API platform whose gateway forwards requests to backend services and can apply policies.
• Google Apigee: a managed platform for creating and deploying API proxies in front of backend services.
• Kong Gateway: gateway software where routes send matching requests to configured services.
• NGINX and Envoy: proxy software that can be configured to route API traffic; available features depend on the product and configuration.

These are examples, not a ranking. A team often starts by considering the cloud it already uses, whether it wants a managed service, and what policies and traffic it needs to support.

How do you use an API gateway?

The exact setup depends on the gateway, but the basic steps are similar:

1. Create or run the gateway using a managed cloud service or software in your own environment.
2. Register the backend services with addresses the gateway can reach.
3. Define routes that match request paths and methods, then send each route to its service.
4. Choose any shared policies you need, such as authentication, rate limits, or request logging.
5. Give clients the gateway address and test that each API request reaches the expected service.

For our ride app, routes might look like this:

Official getting-started guides

• Amazon API Gateway: create routes
• Azure API Management: key concepts
• Google Apigee: build a simple API proxy
• Kong Gateway: services and routes