API Gateway Pattern

The “Front Door” of Microservices

In a microservices architecture, a single client request (like “Show me my dashboard”) might require data from ten different services. If the client had to call each service individually, the performance would be terrible, and the security surface would be enormous.

An API Gateway acts as a single entry point for all clients. It sits between the client and the internal services, acting as a reverse proxy that orchestrates the communication.

Core Responsibilities

1. Request Routing: Forwards requests to the appropriate service based on the path (e.g., /api/v1/orders -> Order Service).
2. Request Aggregation: Fans out a single client request to multiple downstream services, combines their results, and returns a single JSON object.
3. Cross-Cutting Concerns: Centralizes authentication, SSL termination, rate limiting, and logging in one place.
4. Protocol Translation: Can translate between modern external protocols (HTTP/2, REST) and internal high-performance protocols (gRPC, SignalR).

Architecture Styles

1. The Single Gateway

One gateway for all clients (Mobile, Web, 3rd party).

• Cons: Can become a “bottleneck” where all teams are fighting to change the same config file.

2. Backend for Frontend (BFF)

Specific gateways for specific client types.

• Example: A Mobile-Gateway that returns smaller payloads and a Web-Gateway that returns rich data.
• Pros: Perfectly optimized for the consumer’s needs.

Technical Comparison

Practice Exercise

Design the flow for a “Product Detail” page request that requires data from Catalog, Inventory, and Review services.

Answer

The Aggregation Workflow

1. Client sends GET /products/123.
2. Gateway intercepts the call and verifies the JWT token.
3. Fan-out: The Gateway sends three parallel requests:
   • internal/catalog/123
   • internal/inventory/123
   • internal/reviews/123
4. Wait: The Gateway waits for the slowest service to respond or hits a timeout.
5. Merge:

   {
     "product": { "name": "Laptop", "price": 999 },
     "stock": 42,
     "reviews": [{ "user": "Nhon", "rating": 5 }]
   }

6. Response: Client receives the merged object in a single HTTP trip.

Why This Architecture Works

1. Performance: For mobile users on high-latency 4G/5G networks, reducing three trips to one is a massive UX win.
2. Security: Internal services can stay on a private network with no public IP. Only the Gateway is exposed to the internet.
3. Flexibility: You can rename an internal service or change its protocol (e.g., switch Inventory from REST to gRPC), and the client doesn’t need to change a single line of code.

Summary

The API Gateway is the central nervous system of a distributed architecture. While it introduces a single point of failure (which must be mitigated with high availability), the benefits in security, performance, and developer productivity make it a non-negotiable component of any production-grade microservices system.