What is an API Gateway?
An API gateway, told as a story about the front gate booth that sends every guest to the right window.
Every guest runs to a different booth on their own.Not knowing where to go, they wander the whole park.
12 rides, 12 booths — no way to tell which is which.The more booths there are, the harder it is to find the right one alone.
One booth takes everyone and sends them to the right window.One entrance, one ID check, one set of directions.
One door in, many paths out.The booth looks at each guest and decides which ride to send them to.
If the one booth breaks, the whole park locks up.So parks keep more than one booth and split the load between them.
An API gateway = one front booth that checks ID, shows the way, and throttles the crowd for every guest.
A single entry point for incoming requests that handles authentication, authorization, routing, and rate limiting in one place — instead of every backend service implementing it separately.
When grown-ups say it
- API gateway
- The front gate booth. Every request passes through here first.
- Authentication
- Showing your ID. Confirms who you are.
- Authorization
- Checking you're allowed in. After knowing who you are, it checks what you're allowed to do.
- Routing
- The booth pointing the way. Sends each request to the right backend window.
- Rate limiting
- Letting in only so many at a time. The booth throttles before things get overwhelmed. → the memo board of frequent answers
- Single entry point
- There's only one door in. Which means if that one door breaks, nobody gets in.
- Load balancer
- The device that splits guests across several booths. Used when one booth isn't enough. → the traffic officer who splits the queue
- Service mesh
- The dedicated path rides use to talk to each other. The gateway sits between guests and rides; a service mesh sits between rides themselves. → the dedicated path between rides