API Gateway in 1 diagram and 147 words
Explained as simply as possible… but not simpler.
A single entry point that handles and routes API requests to backend services.
In modern architectures (especially microservices), multiple services handle different parts of an application. Instead of clients calling each service directly, an API Gateway sits in front, managing all incoming requests. It simplifies client logic, enforces policies, and can aggregate multiple service responses.
Use it when you have multiple services and want to centralise access, authentication, logging, and request handling.
You need to know
It can manage authentication, rate limiting, caching, and logging across all services.
It forwards requests to the right microservice based on the path or rules.
It can combine results from multiple services into one response to reduce client complexity.
Popular technologies
Amazon API Gateway - Managed, scalable option on AWS.
Kong - Open-source and extensible API gateway with plugins.
NGINX - Often used as a reverse proxy or gateway in high-performance setups.
Like posts like this?
Every week, you'll get a new system design concept, broken down like this one.
Free subscribers also get a little bonus:
🎁 The System Design Interview Preparation Cheat Sheet
If you're into visuals, paid subscribers unlock:
→ My Excalidraw system design template – so you have somewhere to start
→ My Excalidraw component library – used in the diagram of this issue
No pressure though. Your support helps me keep writing, and I appreciate it more than you know ❤️
Hi
API Gateway structure, moving beyond simple API keys. Imagine a central API Gateway acting as the single entry point. Instead of basic keys, it leverages context-aware authentication. Upon request, it analyzes various factors like user identity (via federated identity providers like Okta or Azure AD), device posture (is it a trusted corporate device?), network location, and even behavioral biometrics.
graph LR
A[Client Application] --> B(API Gateway);
B --> C{Context-Aware Authentication & Authorization};
C -- User Identity, Device Posture, Network, Biometrics --> D[Federated Identity Provider];
C -- Attributes --> E[Policy Decision Point (PDP)];
E --> C;
C -- Issues Scoped OAuth 2.0 Token --> F[Backend Microservice 1];
C -- Issues Scoped OAuth 2.0 Token --> G[Backend Microservice 2];
B -- mTLS --> F;
B -- mTLS --> G;
B --> H[Centralized Monitoring System];
Good luck!
SUMAN SUHAG
Great Read✨