What an API gateway does

API design: REST, HTTP, GraphQL and gRPC Mid-level Python 3.13+ PostgreSQL 17+ Reviewed By Best Latest Apps

Pick the fix

Which responsibility belongs in the gateway, not the order service?

Options
Hint 1 of 1

Which check needs no business data?

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A Rejecting requests with an invalid or expired access token

Correct. A uniform edge check every service benefits from.

A gateway can check what every request has in common, like whether the token is valid. Whether this user may touch order 42 needs the order's data, so that check stays in the service that owns it.

Why not the others?
  • B Checking the user owns order 42 before editing. Object-level authorization needs order data.
  • C Calculating discounts. Business logic.
  • D Deciding which warehouse ships. Domain logic.

30-second answer

A gateway is the single entry point that handles cross-cutting edge concerns: TLS termination, routing to services, authentication (validating tokens), coarse rate limits, request size limits, CORS, and request logging with trace ids. Business rules and fine-grained authorization stay in the services, because only they know whether this user may edit this order. A backend-for-frontend is a gateway variant shaped for one client type.

Practise saying it · 30 s. No recording, just a timer

What does an API gateway do?

Say your answer out loud, then check which of these points you covered:

  • Edge concerns: TLS, routing, auth, limits
  • Thin
  • Services still authorize
  • BFF variant
  • HA and latency

Deep dive

Keep the gateway thin; logic there becomes a shared bottleneck owned by no team.

Propagate identity to services in a verified form (signed token or mTLS-protected header).

Services must still check authorization; never trust that 'the gateway checked'.

Gateways add a hop; watch their latency and make them highly available.

Common mistakes

  • Business logic in gateway plugins.
  • Services trusting an X-User-Id header that any internal caller can set.
  • One gateway configuration that every team edits.

Senior take & follow-ups

List the edge concerns, then insist authorization of business objects stays in services.

Follow-up questions

Think of your answer first, then open the hint.

  1. Gateway or service mesh?

    Show hint

    Gateway: north-south (client to services). Mesh: east-west (service to service).

  2. What is a BFF?

    Show hint

    A backend per client type that aggregates and shapes calls.

Related questions

Suggest a fix if something here is wrong or out of date.