API Gateway Explainer
An API gateway is a service that sits in front of one or more application services and provides a single entry point for requests. Instead of a mobile app or website needing to know every internal service address, it can send a request to the gateway. The gateway then checks the request and routes it to the appropriate service, sometimes combining answers before returning a response.
This central position makes a gateway useful for common tasks. It can authenticate a caller, enforce rate limits, apply traffic rules, log activity, and translate between different external and internal interfaces. For example, an application may request account information from one public endpoint while the gateway contacts separate identity, billing, and profile services behind the scenes.
A gateway is not necessarily where business decisions belong. Complex application logic is usually kept in the services that own the data and behavior. If every rule is moved into the gateway, it can become difficult to change and may turn into a bottleneck. A well-designed gateway focuses on traffic management and shared policies while allowing individual services to remain responsible for their own domain.
Availability matters because the gateway may handle a large portion of a system’s incoming traffic. Operators commonly run multiple instances, use load balancing, monitor errors, and plan for failures. Rate limits and timeouts can protect back-end services when a caller sends too many requests or one dependency responds slowly.
API gateways are often used with microservices, but they can support many other architectures. Their central idea is controlled entry: provide clients with a stable, secure path into a set of services without exposing every internal detail directly.
An API gateway is a front door for application requests. It routes traffic to services and can apply shared policies such as authentication, rate limits, and logging.
It gives clients one stable interface while allowing internal services to change or remain private. It can also combine several service calls into one response.
Most detailed business logic should remain with the service that owns the data. Keeping the gateway focused on routing and common controls helps prevent it from becoming a bottleneck.
Explore more "Explainers"
Discover additional explainers across politics, science, business, technology, and other fields. Each explainer breaks down a complex idea into clear, everyday language—helping you better understand how major concepts, systems, and debates shape the world around us.