API Gateway
One public front door that routes API calls to the right service and applies shared rules like auth, quotas, and logging.
See it
What it is
An API gateway is the public front door in front of one or more backend services. It terminates client connections, matches routes, and proxies each request to the right service. Products such as Kong Gateway and Amazon API Gateway can also centralize authentication, rate limiting, request limits, and access logs.
Reach for one when several services need one domain and a consistent edge policy. It can hide internal topology from clients and keep token verification or quotas out of every service, while the services still enforce their own resource-level authorization.
The gateway sits on every request, so a bad rule or overloaded instance has a wide blast radius. Keep transformations small, set upstream timeouts, preserve correlation IDs, and avoid moving core business logic into plugins. A gateway overlaps with a reverse proxy and load balancer, but its defining job is API-aware policy and routing.
Ask AI for it
Configure Kong Gateway declaratively in front of the users and orders services. Route /api/users and /api/orders without exposing upstream hosts, enable the JWT, rate-limiting, and correlation-id plugins, cap request bodies, and set connect, read, and write timeouts. Preserve the correlation ID upstream, return a consistent JSON error envelope for gateway failures, expose health checks, and add tests for routing, an invalid JWT, quota exhaustion, timeout, and unavailable upstreams.