An API Gateway sits between clients and backend services, routing requests and applying shared controls.
An API gateway is a controlled entry point for API traffic.
Instead of every mobile app, browser, or partner integrating with every backend service, clients can call one public API boundary. The gateway decides where each request should go and applies rules that should be consistent across services.
Core idea: one managed API entry point can hide backend complexity while making shared policies easier to operate.
Think of an API gateway like the reception desk of an office building.
The desk checks who is allowed in, reads the visitor’s destination, applies building rules, and directs the visitor to the right department. The departments do the actual work; the desk creates a consistent front door.
A gateway concentrates cross-cutting API responsibilities at the boundary, so product teams do not have to rebuild the same controls in every service.
Check whether the caller presents a valid identity, token, or API key.
Apply access rules before a request reaches a protected capability.
Send a path such as /orders or /profile to the right service.
Control how many requests a client can make in a time window.
Reject malformed or disallowed requests at the boundary.
Record useful request logs, metrics, traces, and correlation IDs.
Trade-off: centralizing these controls improves consistency, but the gateway becomes an important dependency. It needs capacity, monitoring, safe deployments, and a clear failure plan.
API gateways are especially useful when several clients or services need one stable, policy-controlled API boundary.
Give different clients a stable API surface while backend services evolve behind it.
Apply authentication, quotas, versioning, and monitoring for external consumers.
Keep service discovery and internal routing away from client code.
Combine data from account, catalog, order, and payment services behind one request.
Shape a response so a mobile client receives less data or fewer round trips.
Route some traffic to a new service while the old implementation is retired.
Imagine a food-delivery app that serves customers, restaurants, and delivery partners.
The mobile app has one address to integrate with even when backend ownership is split across teams.
During a promotion, the team can protect the API from abusive traffic, watch error rates by route, and release service changes without forcing every client to update at once.
The gateway coordinates the boundary; it does not replace the order, payment, or courier services that own the business rules.
A gateway and a load balancer can appear together, but they answer different questions. The gateway decides whether and where an API request should enter the system; the load balancer chooses a healthy instance among equivalent destinations.
API gateway: manages an API boundary with authentication, rate limits, validation, and routing. Load balancer: distributes traffic across healthy instances.
API gateway: directs and protects requests. Backend service: owns business logic such as calculating a price or creating an order.
API gateway: enforces an access decision at the edge. Authentication system: proves or manages identity and issues credentials.
API gateway: usually manages traffic entering from clients. Service mesh: manages communication and policy between internal services.
API gateway: handles API requests and shared controls. CDN: caches and serves content from edge locations close to users.
A gateway can protect or route traffic, but it does not automatically add backend capacity. Scaling and capacity planning remain separate decisions.
| ENGLISH TERM | 中文 | SIMPLE ENGLISH | 中文小白理解 |
|---|---|---|---|
| API Gateway | API 网关 | A managed entry point between clients and backend services. | 位于客户端和后端服务之间、统一管理请求入口的组件。 |
| API Boundary | API 边界 | The place where API traffic enters and leaves a system. | API 请求进入和离开系统的边界位置。 |
| Route | 路由 | A rule that sends a request to a destination. | 把请求送到目标服务的规则。 |
| Rate Limit | 速率限制 | A limit on how many requests a caller can make. | 限制调用方可以发送多少请求。 |
| Request Validation | 请求校验 | Checking that a request has an allowed shape and value. | 检查请求的格式和内容是否符合要求。 |
| API Version | API 版本 | A named revision of an API contract. | API 接口约定的某个版本。 |
| Aggregation | 聚合 | Combining results from multiple services into one response. | 把多个服务的结果合并成一个响应。 |
| Correlation ID | 关联 ID | An identifier used to follow one request across services. | 用来串起一次请求在多个服务中流转过程的标识。 |
| Backend Service | 后端服务 | A service that performs application or business work. | 负责执行应用或业务工作的服务。 |
| Service Mesh | 服务网格 | Infrastructure for managing communication between internal services. | 管理内部服务之间通信的基础设施层。 |
An API gateway is a managed front door for backend APIs.
It routes requests and centralizes shared controls such as authentication, rate limits, validation, and observability.
For a product decision, name the client promise, the policies being centralized, the gateway owner, the failure plan, and the metrics that show the boundary is helping.