My developer friends, how are we all doing? 👋 I am certain that just like all of us, the management of microservices was a headache for you. After all, it is an unparalleled endeavor. Congratulations, you’ve accomplished the arduous task of tearing your monolith into separate services. That’s awesome! Unfortunately, we have a web of disparate API calls, authentication problems, and traffic storms. Do you relate? In these situations, API gateways are useful. You can think of them as fences around your microservices world. They manage the chaos, letting your services concentrate on their assigned jobs. In this post, I will cover the most common patterns, tools, and challenge areas, so you don’t have to spend time tackling them yourself. Let’s get right to it! What Is the Importance of API Gateways? Imagine this for a second: You have 20 microservices to deal with, each having their very own API, authentication logic and rate limits. Now, coordinating all of this with web, mobile and third-party clients? That's downright nightmare inducing, huh? An API gateway functions as the main entry point through which all requests are supposed to go. It manages: Routing: The User Service is routed for guy “/users” and Order Service for “/orders”.
Security: Auth checks are done only once for all services instead of getting verified continuously.
Traffic Control: Intercept DDoS attacks before they torch your servers.
Transformation: Take that XML response and transform it to JSON for the mobile app. Routing: The User Service is routed for guy “/users” and Order Service for “/orders”. Security: Auth checks are done only once for all services instead of getting verified continuously. Traffic Control: Intercept DDoS attacks before they torch your servers. Transformation: Take that XML response and transform it to JSON for the mobile app. But here’s what is important, not all gateways are the same. Let’s analyze the patterns that will not only preserve your wellbeing, but also the ones that will drain your time and energy. Important API Gateway Patterns: A guide for developers Important API Gateway Patterns: A guide for developers 1. Backend for Frontend (BFF): Your Frontend’s Best Buddy 1. Backend for Frontend (BFF): Your Frontend’s Best Buddy What it solves: How many times did you have to change the API because the mobile team wanted one form while the web team wanted another one? The BFF pattern builds specialized gateways for every sort of client. How It Works: Web BFF: Combines data from various services to enrich dashboard UI with multiple services.
Mobile BFF: Returns small, optimized payloads to help save bandwidth.
Third Party BFF: Restricts external partners to certain endpoints. Web BFF: Combines data from various services to enrich dashboard UI with multiple services. Mobile BFF: Returns small, optimized payloads to help save bandwidth. Third Party BFF: Restricts external partners to certain endpoints. For example, the mobile version of your e-commerce app requires productId, name and price. The web version needs reviews, stock status, and related items. Instead of making a single API to cater all, create two BFFs. # Mobile BFF route  
GET /mobile/products/{id} → Product Service (basic fields)  

# Web BFF route  
GET /web/products/{id} → Product Service + Reviews Service + Inventory Service # Mobile BFF route  
GET /mobile/products/{id} → Product Service (basic fields)  

# Web BFF route  
GET /web/products/{id} → Product Service + Reviews Service + Inventory Service BFF Shared Library - some gotchas BFF Shared Library - some gotchas Duplication: Avoid copy-pasting the logic when auth is needed on both BFFs – it’s best to employ a shared library or sidecar.
Overhead: CI/CD pipelines are required for every BFF you manage. Good luck with 5 BFFs.
Self Check: Do my clients have very dispersed requirements or can they be serviced through one gateway? Duplication: Avoid copy-pasting the logic when auth is needed on both BFFs – it’s best to employ a shared library or sidecar. Duplication: Overhead: CI/CD pipelines are required for every BFF you manage. Good luck with 5 BFFs. Overhead: Self Check: Do my clients have very dispersed requirements or can they be serviced through one gateway? Self Check: 2. Rate Limiting: Stopping Traffic Tsunamis 2. Rate Limiting: Stopping Traffic Tsunamis What it Solves: Prevents the over abuse of your services, like someone using your ‘end-point’ for ‘/checkout’ 1000 times/minute, as well as protecting your bank account from the surprise of the cloud bill. What it Solves: Implementation: Implementation: Token Bucket Algorithm: Users have tokens which they spend to make a request and over time refill them.
IP vs User Based Limits: Block abusive ip addresses or restrict free tier users. Token Bucket Algorithm: Users have tokens which they spend to make a request and over time refill them. IP vs User Based Limits: Block abusive ip addresses or restrict free tier users. Tools in Action: Tools in Action: Kong: The Plugins for rate-limiting and the bot-detection are a goldmine.
AWS API Gateway: Custom API-keys can have quotas and attached plans which control their usage. Kong: The Plugins for rate-limiting and the bot-detection are a goldmine. AWS API Gateway: Custom API-keys can have quotas and attached plans which control their usage. Pro Tip: Fixed intervals are less preferable than sliding windows. If, for example, your limit is 4 requests to make within 60 seconds, let people make short bursts of up to 120 requests within 30 seconds, with the average during the 60 seconds being below 100. Pro Tip: Example Configuration (Kong): Example Configuration (Kong): # Limit to 10 requests/minute per user  
curl -X POST http://localhost:8001/plugins   
  --data "name=rate-limiting"   
  --data "config.minute=10"   
  --data "config.policy=local" # Limit to 10 requests/minute per user  
curl -X POST http://localhost:8001/plugins   
  --data "name=rate-limiting"   
  --data "config.minute=10"   
  --data "config.policy=local" Be Mindful Of: Be Mindful Of: Doubtful Assignments: Real users getting stuck on caps during busy sales for certain periods. Set a limit but let them try again with a helpful optional retry header.
A Worry: Tiers (premium versus free) can be problematic. Doubtful Assignments: Real users getting stuck on caps during busy sales for certain periods. Set a limit but let them try again with a helpful optional retry header. Doubtful Assignments: A Worry: Tiers (premium versus free) can be problematic. A Worry: 3. Authentication & Authorization: Managing Your APIs 3. Authentication & Authorization: Managing Your APIs How It’s Done: What is the strategy for ensuring only authorized people and automated accounts invoke your endpoints? Best Practices: Best Practices: Gate Auth at the Gateway: Validate JWT and OAuth2 credential tokens once.
Claims are Passed: Use headers such as X-User-ID or X-Roles to avoid re-validating by services. Gate Auth at the Gateway: Validate JWT and OAuth2 credential tokens once. Claims are Passed: Use headers such as X-User-ID or X-Roles to avoid re-validating by services. Example Flow: Example Flow: Client → API Gateway → [Auth Service] → "Is this token valid?"  
↓  
If yes: Route request to Service A with `X-User-ID=123`  
If no: Return 401 Unauthorized Client → API Gateway → [Auth Service] → "Is this token valid?"  
↓  
If yes: Route request to Service A with `X-User-ID=123`  
If no: Return 401 Unauthorized Tools: Tools: Istio: Apply policies at the service mesh level using AuthorizationPolicy.


AWS Cognito + API Gateway: Serverless scalable auth. Istio: Apply policies at the service mesh level using AuthorizationPolicy. Istio: Apply policies at the service mesh level using AuthorizationPolicy. AWS Cognito + API Gateway: Serverless scalable auth. AWS Cognito + API Gateway: Serverless scalable auth. Be Mindful Of: Be Mindful Of: Token Hijacking: Implement short token lifetimes and enforce HTTPS.


Performance: Tokens should be validated in RAM (e.g. validating in Redis’ token cache). Token Hijacking: Implement short token lifetimes and enforce HTTPS. Token Hijacking: Implement short token lifetimes and enforce HTTPS. Performance: Tokens should be validated in RAM (e.g. validating in Redis’ token cache). Performance: Tokens should be validated in RAM (e.g. validating in Redis’ token cache). Challenge Yourself: “Do I have to hit the auth service for every request, or is there a way to cache the auth results?" Challenge Yourself: API Gateway Tools: An Editing Guide for Developers API Gateway Tools: An Editing Guide for Developers Kong. The Swiss Army Knife. Best for: Customizability. You need a Kafka pluging? Get it here. Example: A startup uses Kong to implement OAuth2, rate limiting, and logging features without any coding. Watch out: What about scaling and security if you have to maintain your own Kong nodes?


Istio: The Kubernetes Maestro Best for: Employees of already existing Kubernetes ecosystems get the most out of this service mesh + API Gateway. This is literally the best. A chef's kisss. Example: Splitting incoming traffic between v1 and v2 of a service is a great way to speed up A/B testing. Watch out: This is out of the question if you not entirely into Kubernetes.


NGINX: The Reliable Workhorse Best for: Easiest to use for people who want great results without too much hassle. Example: Iterating on an existing chai tea microservices application where the NGINX does reverse proxying. Watch out: Better get an Ansible or Terraform because those configuration files will rot away without clean up automation.


AWS API Gateway: The Serverless Sidekick Best for: Kong helps Serverless stacks with example application implementations. (Lambda + API Gateway = ❤️ ). Example: Serverless backend for an ecommerce project that uses auto-scaling. Watch out: You really need to carefully monitor usage or else, boom, cost explosion. Kong. The Swiss Army Knife. Best for: Customizability. You need a Kafka pluging? Get it here. Example: A startup uses Kong to implement OAuth2, rate limiting, and logging features without any coding. Watch out: What about scaling and security if you have to maintain your own Kong nodes? Kong. The Swiss Army Knife. Best for: Customizability. You need a Kafka pluging? Get it here. Example: A startup uses Kong to implement OAuth2, rate limiting, and logging features without any coding. Watch out: What about scaling and security if you have to maintain your own Kong nodes? Kong Istio: The Kubernetes Maestro Best for: Employees of already existing Kubernetes ecosystems get the most out of this service mesh + API Gateway. This is literally the best. A chef's kisss. Example: Splitting incoming traffic between v1 and v2 of a service is a great way to speed up A/B testing. Watch out: This is out of the question if you not entirely into Kubernetes. Istio: The Kubernetes Maestro Best for: Employees of already existing Kubernetes ecosystems get the most out of this service mesh + API Gateway. This is literally the best. A chef's kisss. Example: Splitting incoming traffic between v1 and v2 of a service is a great way to speed up A/B testing. Watch out: This is out of the question if you not entirely into Kubernetes. Istio NGINX: The Reliable Workhorse Best for: Easiest to use for people who want great results without too much hassle. Example: Iterating on an existing chai tea microservices application where the NGINX does reverse proxying. Watch out: Better get an Ansible or Terraform because those configuration files will rot away without clean up automation. NGINX: The Reliable Workhorse Best for: Easiest to use for people who want great results without too much hassle. Example: Iterating on an existing chai tea microservices application where the NGINX does reverse proxying. Watch out: Better get an Ansible or Terraform because those configuration files will rot away without clean up automation. NGINX AWS API Gateway: The Serverless Sidekick Best for: Kong helps Serverless stacks with example application implementations. (Lambda + API Gateway = ❤️ ). Example: Serverless backend for an ecommerce project that uses auto-scaling. Watch out: You really need to carefully monitor usage or else, boom, cost explosion. AWS API Gateway: The Serverless Sidekick Best for: Kong helps Serverless stacks with example application implementations. (Lambda + API Gateway = ❤️ ). Example: Serverless backend for an ecommerce project that uses auto-scaling. Watch out: You really need to carefully monitor usage or else, boom, cost explosion. AWS API Gateway: The Dark Side of API Gateways: Avoid these pitfalls The Dark Side of API Gateways: Avoid these pitfalls Over–Engineering The Sin: Implementing a service mesh for a 3-service app is wasted.
The Solution: Begin with the basics. Use NGINX or a managed gateway and increase the complexity based on your requirements. Over–Engineering The Sin: Implementing a service mesh for a 3-service app is wasted.
The Solution: Begin with the basics. Use NGINX or a managed gateway and increase the complexity based on your requirements. Over–Engineering The Sin: Implementing a service mesh for a 3-service app is wasted. Over–Engineering The Sin: Implementing a service mesh for a 3-service app is wasted. The Solution: Begin with the basics. Use NGINX or a managed gateway and increase the complexity based on your requirements. Not Accounting Observability The Sin: Absence of measurements on lag, faults, and rate limiting.
The Fix: Implemented Grafana + Prometheus for monitoring: Rates of 4xx/5xx responses Average response time Rate limit requests


Vendor Lock In The Sin: Over Arching everything around the AWS API Gateway, then needing to change it becomes extremely expensive.
The Fix: Use a Serverless Framework or Terraform to abstract the gateway logic. Not Accounting Observability The Sin: Absence of measurements on lag, faults, and rate limiting.
The Fix: Implemented Grafana + Prometheus for monitoring: Rates of 4xx/5xx responses Average response time Rate limit requests Not Accounting Observability The Sin: Absence of measurements on lag, faults, and rate limiting. Not Accounting Observability The Sin: The Fix: Implemented Grafana + Prometheus for monitoring: Rates of 4xx/5xx responses Average response time Rate limit requests Vendor Lock In The Sin: Over Arching everything around the AWS API Gateway, then needing to change it becomes extremely expensive.
The Fix: Use a Serverless Framework or Terraform to abstract the gateway logic. Vendor Lock In The Sin: Over Arching everything around the AWS API Gateway, then needing to change it becomes extremely expensive. Vendor Lock In The Sin: The Fix: Use a Serverless Framework or Terraform to abstract the gateway logic. FAQ: Your Most Pressing Questions, Addressed FAQ: Your Most Pressing Questions, Addressed Q: When should I implement a Backends For Frontends (BFF) compared to one single Gateway? A: Implement BFFs if your clients web and mobile, or any external client require exceptionally different information otherwise it is best kept simple. Q: Can I deploy several API gateways? A: Absolutely! Internal services can utilize Kong while external services can use AWS API Gateway. Just be cautious of complexity. Q: What if the gateway fails? A: Gateways should be deployed in a cluster with load balancing; have circuit breakers in place, such as Hystrix, to fail softly. Q: Can I use an API gateway in place of a Service Mesh? A: Certainly not! A gateway manages traffic from north to south (from the client to the service) while a mesh handles east-west traffic (from one service to another). Final Thoughts: Your Gateway To Greatness Final Thoughts: Your Gateway To Greatness API gateways, are not some magic tool, they are something you create and control. Just like any other tool they need to be utilized to their full potential in order to see desired outcomes. Prior to Beginning Construction: Identify Your Requirements: Evaluate whether you require authentication, rate limiting, or protocol translation assistance.


Get Familiar With The Tools: Launch Kong and AWS API Gateway in a sandbox. Which of the two is more suitable?


Plan for Future Growth: Will your gateway be capable of accommodating 10 times the traffic next year? Identify Your Requirements: Evaluate whether you require authentication, rate limiting, or protocol translation assistance. Identify Your Requirements: Evaluate whether you require authentication, rate limiting, or protocol translation assistance. Get Familiar With The Tools: Launch Kong and AWS API Gateway in a sandbox. Which of the two is more suitable? Get Familiar With The Tools: Launch Kong and AWS API Gateway in a sandbox. Which of the two is more suitable? Plan for Future Growth: Will your gateway be capable of accommodating 10 times the traffic next year? Plan for Future Growth: Will your gateway be capable of accommodating 10 times the traffic next year? It is critical to note that the goal is not to construct the ultimate gateway; instead, it is to address present issues while avoiding hindering future solutions. Now, go untangle that microservices spaghetti. 🍝

Terra

Buddy

dashboard

Scalability in Microservices: Creating Systems That Can Scale Effortlessly

Too Long; Didn't Read

Get Free Unlimited IP Geo Data With IPinfo Lite

You Split Up Your Monolith—Now API Gateways Are Here to Save Your Butt

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

Untitled Story

How WebSockets Power Real-Time Apps

10 Indications That You Should Invest in Automation Via APIs

10 Best Practices for Securing Your API

113 Stories To Learn About Api Development

21 API Monitoring Tools That Will Make You a Developer Superhero in 2023!

How WebSockets Power Real-Time Apps

10 Indications That You Should Invest in Automation Via APIs

10 Best Practices for Securing Your API

113 Stories To Learn About Api Development

21 API Monitoring Tools That Will Make You a Developer Superhero in 2023!

Light-Mode

Classic

Newspaper

Dark-Mode

Neon Noir

Minty

HN StartUps