API Gateway

An API Gateway is a server-side component that acts as a single entry point for a collection of backend services — serverless functions, microservices, or legacy APIs — handling request routing, protocol translation, authentication, rate limiting, and caching. It decouples the client-facing API from the internal service topology, allowing backend services to evolve, scale, and be replaced without changing the external contract.

The gateway is not merely a router; it is a policy enforcement point. It is where cross-cutting concerns — security, logging, traffic shaping, circuit breaking — are centralized so that individual services need not implement them. In this sense, the API gateway is the inverse of a microservice: it is a monolith of coordination, extracting complexity from services and concentrating it at the edge.

The tension is clear: the gateway becomes a bottleneck, a single point of failure, and a hotspot for organizational politics. Every team wants their routing rule, their auth scheme, their rate limit in the gateway. Without disciplined governance, the API gateway becomes the distributed monolith it was designed to prevent.