Java: What is API Gateway?

API Gateway — a single entry point that receives all client requests and routes them to the appropriate backend microservice. It acts as a reverse proxy, handling cross-cutting concerns so individual services don't have to.

System Design Context: Without an API gateway, clients must know the exact URL of each microservice and handle authentication, rate limiting, and protocol translation themselves. The gateway centralizes these concerns and provides a unified API surface.

Core Responsibilities:

• Request Routing — map external URLs to internal services.
• Authentication/Authorization — validate JWT tokens, API keys.
• Rate Limiting — protect backend services from overload.
• Load Balancing — distribute traffic across instances.
• Request/Response Transformation — protocol translation, header manipulation.
• SSL Termination — handle HTTPS at the gateway.
• Request Aggregation — combine multiple service calls into one response.
• Caching — cache frequent responses.
• Logging & Monitoring — centralized access logs.

Spring Cloud Gateway — Production Configuration:

1@Configuration
2public class GatewayConfig {
3
4    @Bean
5    public RouteLocator routes(RouteLocatorBuilder builder) {
6        return builder.routes()
7            .route("users", r -> r
8                .path("/api/users/**")
9                .filters(f -> f
10                    .stripPrefix(1)
11                    .addRequestHeader("X-Forwarded-By", "gateway")
12                    .retry(config -> config
13                        .setRetries(3)
14                        .setBackoff(Duration.ofMillis(100),
15                            Duration.ofSeconds(1), 2, true)))
16                .uri("lb://user-service"))
17            .route("orders", r -> r
18                .path("/api/orders/**")
19                .filters(f -> f
20                    .circuitBreaker(config -> config
21                        .setName("orderService")
22                        .setFallbackUri("forward:/fallback/orders")))
23                .uri("lb://order-service"))
24            .route("auth", r -> r
25                .path("/api/auth/**")
26                .filters(f -> f
27                    .rateLimiter(config -> config
28                        .setRateLimiter(rateLimiter)
29                        .setKeyResolver(userKeyResolver)))
30                .uri("lb://auth-service"))
31            .build();
32    }
33
34    @Bean
35    public GlobalFilter customGlobalFilter() {
36        return (exchange, chain) -> {
37            long startTime = System.currentTimeMillis();
38            return chain.filter(exchange).then(Mono.fromRunnable(() -> {
39                long duration = System.currentTimeMillis() - startTime;
40                log.info("Request to {} took {}ms",
41                    exchange.getRequest().getPath(), duration);
42            }));
43        };
44    }
45}

Production Concerns:

• High availability — run multiple gateway instances behind a load balancer.
• Circuit breaker — protect against cascading failures.
• Timeout configuration — set appropriate timeouts per route.
• Connection pooling — manage connections to backend services.

Common Pitfalls:

• Single point of failure — gateway down means all APIs down. Fix: multiple instances, health checks.
• Becoming a bottleneck — all traffic funnels through gateway. Fix: caching, async processing, horizontal scaling.
• Over-engineering — adding too many filters. Fix: keep gateway thin, push business logic to services.

Monitoring:

• Track request latency per route and overall.
• Monitor error rates (4xx, 5xx) per service.
• Alert on rate limit rejections.
• Dashboard: Grafana with gateway metrics.

Benefits:

• Centralized cross-cutting concerns.
• Simplified client — one URL for all services.
• Security at one point — easier to audit and update.
• Protocol translation — REST to gRPC, WebSocket proxying.