Home/Learn/Microservices/API Gateway Pattern

API Gateway Pattern

Intermediate

Discovery & Gateway

A single entry point that handles routing, authentication, rate limiting, SSL termination, and request/response transformation, shielding clients from internal topology.

Overview

The API Gateway is the front door for all client requests in a microservices architecture. Without it, clients must know the addresses of every service, handle cross-cutting concerns (auth, rate limiting, SSL) in each service, and make multiple requests to assemble a response. The gateway solves this by acting as a single entry point: it routes requests to the appropriate upstream service, handles authentication and authorisation centrally, enforces rate limits, terminates SSL, transforms requests/responses, and can aggregate calls from multiple services into one client response. In the Spring ecosystem, Spring Cloud Gateway (reactive, Netty-based) is the standard choice.

Core Responsibilities of an API Gateway

Routing: match incoming requests to upstream services by path, host, method, or header. Authentication: validate JWT tokens or API keys at the gateway — downstream services trust the forwarded identity header. Rate Limiting: enforce per-client or per-IP quotas using a Redis-backed token bucket, preventing abuse. SSL Termination: terminate HTTPS at the gateway; internal service-to-service traffic can use plain HTTP or mTLS. Request/Response Transformation: add/remove headers, rewrite paths, or shape payloads before forwarding. Load Balancing: distribute requests across multiple instances of an upstream service via service discovery.

YAML — Spring Cloud Gateway

# Spring Cloud Gateway — application.yml route configuration
spring:
  cloud:
    gateway:
      routes:
        # Route 1: forward /api/orders/** → order-service
        - id: order-service
          uri: lb://order-service          # lb:// = load-balanced via Eureka
          predicates:
            - Path=/api/orders/**
          filters:
            - StripPrefix=1                # strip /api before forwarding
            - name: RequestRateLimiter
              args:
                redis-rate-limiter.replenishRate: 10   # 10 req/sec
                redis-rate-limiter.burstCapacity: 20
                key-resolver: "#{@userKeyResolver}"

        # Route 2: forward /api/users/** → user-service
        - id: user-service
          uri: lb://user-service
          predicates:
            - Path=/api/users/**
          filters:
            - AddRequestHeader=X-Gateway-Source, api-gateway

JWT Authentication at the Gateway

Centralise JWT validation in a gateway filter. The gateway validates the token, extracts the user ID and roles, and forwards them as trusted headers (X-User-Id, X-User-Role) to downstream services. Downstream services read those headers without needing their own JWT library or auth server round-trips — they trust the gateway because they are on a private network.

Java — Spring Cloud Gateway Filter

@Component
public class JwtAuthFilter implements GlobalFilter, Ordered {

    private final JwtTokenProvider tokenProvider;

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        String path = exchange.getRequest().getPath().value();

        // Skip auth for public paths
        if (path.startsWith("/api/auth/")) {
            return chain.filter(exchange);
        }

        String authHeader = exchange.getRequest().getHeaders().getFirst("Authorization");
        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
            exchange.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);
            return exchange.getResponse().setComplete();
        }

        try {
            String token = authHeader.substring(7);
            Claims claims = tokenProvider.validateAndParse(token);

            // Forward identity to downstream services as trusted headers
            ServerHttpRequest mutatedRequest = exchange.getRequest().mutate()
                .header("X-User-Id",   claims.getSubject())
                .header("X-User-Role", claims.get("role", String.class))
                .build();

            return chain.filter(exchange.mutate().request(mutatedRequest).build());
        } catch (JwtException e) {
            exchange.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);
            return exchange.getResponse().setComplete();
        }
    }

    @Override public int getOrder() { return -1; }  // run first
}

Key Points to Remember

1The API Gateway is the single entry point for all external traffic — it shields clients from the internal microservices topology.
2Centralise cross-cutting concerns at the gateway: JWT validation, rate limiting, SSL termination, request logging, and CORS.
3Downstream services trust identity headers (X-User-Id, X-User-Role) forwarded by the gateway — they don't need their own auth logic.
4Spring Cloud Gateway uses Netty and Project Reactor — it is fully reactive and non-blocking, suitable for high-concurrency traffic.
5The gateway should be stateless and horizontally scalable — use Redis for distributed rate limiting and token blacklisting.
6A gateway introduces a single point of failure — deploy multiple instances behind a load balancer with health checks.

Interview Questions

What is an API Gateway and what problems does it solve in a microservices architecture?

EasyAmazon

How would you implement JWT authentication at the gateway level so downstream services don't have to validate tokens?

MediumUber

What is the difference between an API Gateway and a load balancer?

MediumGoogle

How do you implement per-user rate limiting in Spring Cloud Gateway?

HardNetflix

What are the risks of an API Gateway and how do you make it highly available?

MediumFlipkart

Ask Aria about API Gateway Pattern

Your personal AI tutor — ask anything about this concept

Revision Status

Personal Notes

Discussion

Loading discussion…

Service Discovery — Eureka

Spring Cloud Gateway