API gateway concept in Express - Deep Dive

Overview - API gateway concept

What is it?

An API gateway is a server that acts as a single entry point for all client requests to multiple backend services. It receives requests, decides where to send them, and then returns the responses to the clients. This helps simplify communication between clients and complex systems by hiding the details of backend services. It also often handles tasks like security, routing, and data transformation.

Why it matters

Without an API gateway, clients would need to know and communicate directly with many different backend services, making the system complicated and hard to manage. This would lead to duplicated code, inconsistent security, and poor performance. An API gateway solves these problems by centralizing control, improving security, and making the system easier to scale and maintain.

Where it fits

Before learning about API gateways, you should understand basic web servers and REST APIs. After mastering API gateways, you can explore microservices architecture, service meshes, and advanced API management tools.

Mental Model

Core Idea

An API gateway is like a smart receptionist who directs client requests to the right backend service and handles common tasks so clients don’t have to.

Think of it like...

Imagine a hotel lobby with one receptionist. Guests (clients) come to the receptionist with different needs, and the receptionist knows exactly which department or staff member (backend service) to send them to. The guests don’t need to find the right person themselves, making their experience smooth and simple.

┌───────────────┐
│   Clients     │
└──────┬────────┘
       │ Requests
       ▼
┌───────────────┐
│ API Gateway   │
│ - Routes      │
│ - Authenticates│
│ - Transforms  │
└──────┬────────┘
       │ Forwards
       ▼
┌───────────────┐   ┌───────────────┐   ┌───────────────┐
│ Service A     │   │ Service B     │   │ Service C     │
└───────────────┘   └───────────────┘   └───────────────┘

Build-Up - 7 Steps

1

Foundation

What is an API Gateway

Concept: Introduce the basic idea of an API gateway as a single point of entry for multiple backend services.

An API gateway is a server that sits between clients and backend services. Instead of clients calling each service directly, they send requests to the gateway. The gateway then forwards these requests to the appropriate service and returns the response to the client.

Result

Clients interact with one endpoint instead of many, simplifying communication.

Understanding the API gateway as a single entry point helps grasp how it simplifies complex systems.

2

Foundation

Basic Roles of an API Gateway

Concept: Explain the common tasks an API gateway performs beyond routing.

Besides routing requests, an API gateway often handles authentication (checking who the client is), rate limiting (controlling how many requests a client can make), logging, and sometimes transforming data formats between client and service.

Result

The gateway improves security, reliability, and flexibility of the system.

Knowing these roles shows why API gateways are more than just routers.

3

Intermediate

Routing and Load Balancing

🤔Before reading on: do you think the API gateway sends requests to all services or just one? Commit to your answer.

Concept: Learn how the gateway decides which backend service to send each request to and balances load.

The API gateway uses rules to route requests based on URL paths, headers, or other data. It can also distribute requests evenly across multiple instances of a service to balance load and improve performance.

Result

Requests reach the correct service efficiently, and no single service gets overwhelmed.

Understanding routing and load balancing reveals how gateways keep systems responsive and scalable.

4

Intermediate

Security and Authentication Handling

🤔Before reading on: do you think clients authenticate separately with each service or just once with the gateway? Commit to your answer.

Concept: Explore how the gateway manages security by authenticating clients and enforcing access control.

Clients usually authenticate once with the API gateway using tokens or keys. The gateway verifies these credentials and can reject unauthorized requests before they reach backend services. This centralizes security and reduces duplicated effort.

Result

Backend services are protected, and clients have a simpler authentication process.

Knowing that the gateway handles security helps understand how it protects the system and simplifies client interactions.

5

Intermediate

Data Transformation and Aggregation

Concept: Discover how the gateway can modify requests or combine responses from multiple services.

Sometimes clients need data in a different format or combined from several services. The API gateway can transform request or response data formats (like JSON to XML) and aggregate data from multiple services into one response.

Result

Clients get exactly the data they need without extra requests or processing.

Understanding transformation and aggregation shows how gateways improve client experience and reduce network traffic.

6

Advanced

Scaling and Fault Tolerance with API Gateways

🤔Before reading on: do you think the API gateway itself can become a bottleneck or failure point? Commit to your answer.

Concept: Learn how API gateways are designed to handle high traffic and failures gracefully.

API gateways are often deployed in clusters to handle many requests and avoid downtime. They use health checks to detect failing services and route traffic away from them. This ensures the system stays available and responsive even if parts fail.

Result

The system remains stable and scalable under heavy load or partial failures.

Knowing how gateways handle scaling and faults helps design resilient systems.

7

Expert

Internal Architecture and Performance Tradeoffs

🤔Before reading on: do you think adding an API gateway always improves performance? Commit to your answer.

Concept: Understand the internal workings of API gateways and the tradeoffs they introduce.

API gateways add an extra network hop and processing layer, which can add latency. Internally, they use caching, asynchronous processing, and connection pooling to reduce delays. Choosing the right gateway architecture balances flexibility, security, and performance.

Result

Experts can optimize gateway configurations to meet system needs without unnecessary slowdowns.

Understanding internal tradeoffs prevents blindly adding gateways and helps optimize real-world systems.

Under the Hood

An API gateway intercepts client requests and uses routing rules to forward them to backend services. It maintains state like authentication tokens and rate limits. Internally, it manages connections to multiple services, caches responses, and can transform data formats. It often runs as a cluster of servers to handle load and provide failover.

Why designed this way?

API gateways were created to solve the complexity of clients managing many services directly. Centralizing routing, security, and transformation reduces duplicated code and inconsistent policies. Alternatives like clients calling services directly or using simple proxies lacked flexibility and control, so gateways became the standard.

┌───────────────┐
│   Client      │
└──────┬────────┘
       │ Request
       ▼
┌───────────────┐
│ API Gateway   │
│ ┌───────────┐ │
│ │ Router    │ │
│ │ Auth      │ │
│ │ Transformer│ │
│ └───────────┘ │
└──────┬────────┘
       │ Forward
       ▼
┌───────────────┐
│ Backend       │
│ Services      │
└───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does an API gateway replace backend services? Commit to yes or no.

Common Belief: An API gateway replaces backend services by handling all business logic.

Reality: An API gateway only routes and manages requests; backend services still handle business logic.

Why it matters: Confusing the gateway with services leads to poor design and bloated gateways that are hard to maintain.

Quick: Do API gateways always improve performance? Commit to yes or no.

Common Belief: Adding an API gateway always makes the system faster.

Reality: API gateways add extra processing and network hops, which can increase latency if not optimized.

Why it matters: Ignoring this can cause unexpected slowdowns and user frustration.

Quick: Do clients need to authenticate with each backend service when using an API gateway? Commit to yes or no.

Common Belief: Clients must authenticate separately with every backend service.

Reality: Clients usually authenticate once with the API gateway, which then manages access to services.

Why it matters: Misunderstanding this leads to complex client code and duplicated security logic.

Quick: Is an API gateway the same as a load balancer? Commit to yes or no.

Common Belief: An API gateway is just a load balancer that distributes traffic.

Reality: While gateways can load balance, they also handle routing, security, and data transformation, which load balancers do not.

Why it matters: Confusing these roles can cause wrong tool choices and system limitations.

Expert Zone

1

API gateways can implement protocol translation, allowing clients and services to use different communication protocols seamlessly.

2

Caching at the gateway level can drastically reduce backend load but requires careful invalidation strategies to avoid stale data.

3

Some API gateways support serverless functions or plugins to extend functionality without changing backend services.

When NOT to use

Avoid using an API gateway for very simple systems with few services or when ultra-low latency is critical. In such cases, direct client-service communication or lightweight proxies may be better.

Production Patterns

In production, API gateways are often combined with service discovery to dynamically route to healthy service instances. They integrate with centralized logging and monitoring systems to track request flows and errors. Gateways also enforce security policies consistently across all services.

Connections

Reverse Proxy

API gateways build on the reverse proxy pattern by adding routing, security, and transformation.

Understanding reverse proxies helps grasp the basic network forwarding that gateways extend with extra features.

Microservices Architecture

API gateways are a key component in microservices, managing communication between clients and many small services.

Knowing how gateways fit microservices clarifies their role in scaling and organizing complex applications.

Airport Security Checkpoint

Both act as centralized control points that check credentials, direct traffic, and ensure safety before allowing access.

Seeing the gateway as a security checkpoint highlights its role in protecting backend services and managing flow.

Common Pitfalls

#1 Trying to put all business logic inside the API gateway.

Wrong approach:

app.use((req, res) => { /* complex data processing and business rules here */ });

Correct approach:

app.use((req, res, next) => { /* routing and auth only */ next(); }); // Business logic stays in services

Root cause:

Misunderstanding the gateway's role leads to bloated, hard-to-maintain gateways.

#2 Not handling gateway failures, causing total system outage.

Wrong approach:

Single API gateway instance without redundancy or health checks.

Correct approach:

Deploy multiple gateway instances with load balancing and health monitoring.

Root cause:

Ignoring gateway as a critical component creates a single point of failure.

#3 Clients sending requests directly to backend services bypassing the gateway.

Wrong approach:

Client calls http://serviceA.internal/api/data directly.

Correct approach:

Client calls https://api.example.com/serviceA/data through the gateway.

Root cause:

Not enforcing gateway usage breaks security and routing consistency.

Key Takeaways

An API gateway centralizes client requests to multiple backend services, simplifying communication and management.

It handles routing, security, data transformation, and load balancing to improve system scalability and reliability.

API gateways add an extra layer that can introduce latency, so their design and deployment must balance flexibility and performance.

Misusing gateways by adding business logic or ignoring their failure modes leads to maintenance and reliability problems.

Understanding API gateways is essential for building modern, scalable, and secure web applications, especially with microservices.

Practice

1. What is the primary role of an API gateway in a system using Express?

easy

A. It directly serves static files to users.

B. It stores all the data for the application.

C. It acts as a single entry point to route requests to multiple backend services.

D. It replaces the database in the backend.

Solution

1. Step 1: Understand the role of API gateway

   An API gateway acts as a single entry point that routes client requests to appropriate backend services.

2. Step 2: Eliminate incorrect roles

   Storing data, replacing databases, or serving static files are not responsibilities of an API gateway.

3. Final Answer:

   It acts as a single entry point to route requests to multiple backend services. -> Option C

4. Quick Check:

   API gateway = single entry point [OK]

Hint: API gateway routes requests centrally [OK]

Common Mistakes:

• Thinking API gateway stores data
• Confusing API gateway with database
• Assuming it serves static files directly

2. Which Express middleware is commonly used to forward requests in an API gateway setup?

easy

A. http-proxy-middleware

B. express.static()

C. body-parser

D. cors

Solution

1. Step 1: Identify middleware for proxying requests

   The http-proxy-middleware package is used to forward requests from the gateway to backend services.

2. Step 2: Differentiate from other middleware

   express.static() serves static files, body-parser parses request bodies, and cors manages cross-origin requests, none forward requests.

3. Final Answer:

   http-proxy-middleware -> Option A

4. Quick Check:

   Proxy middleware = http-proxy-middleware [OK]

Hint: Proxy requests with http-proxy-middleware [OK]

Common Mistakes:

• Using express.static() to proxy requests
• Confusing body-parser with proxying
• Assuming cors forwards requests

3. Given this Express API gateway code snippet, what will be the output when a client requests /api/users?

const express = require('express');
const { createProxyMiddleware } = require('http-proxy-middleware');
const app = express();

app.use('/api/users', createProxyMiddleware({ target: 'http://localhost:5000', changeOrigin: true }));

app.listen(3000);

medium

A. The request results in a 404 error

B. The request is served by Express app on port 3000

C. The request is blocked by CORS policy

D. The request is forwarded to http://localhost:5000/api/users

Solution

1. Step 1: Analyze the proxy middleware setup

   The middleware forwards requests matching /api/users to http://localhost:5000, preserving the path.

2. Step 2: Understand request forwarding behavior

   The request /api/users on port 3000 is proxied to http://localhost:5000/api/users.

3. Final Answer:

   The request is forwarded to http://localhost:5000/api/users -> Option D

4. Quick Check:

   Proxy forwards /api/users to target URL [OK]

Hint: Proxy forwards matching paths to target server [OK]

Common Mistakes:

• Assuming Express serves the request itself
• Expecting 404 without backend running
• Confusing CORS blocking with proxy behavior

4. Identify the error in this Express API gateway code snippet:

const express = require('express');
const { createProxyMiddleware } = require('http-proxy-middleware');
const app = express();

app.use('/api', createProxyMiddleware({ target: 'http://localhost:4000' }));

app.listen(3000);

// Client requests /api/users but gets no response

medium

A. Missing changeOrigin: true causes backend to reject requests

B. The target URL is incorrect and unreachable

C. The middleware is not mounted on the correct path

D. Express app is not listening on port 3000

Solution

1. Step 1: Check proxy middleware options

   Without changeOrigin: true, the Host header sent to backend remains the gateway's, which may cause backend to reject requests.

2. Step 2: Verify other parts

   The target URL and path are correct, and app listens on port 3000, so those are not errors.

3. Final Answer:

   Missing changeOrigin: true causes backend to reject requests -> Option A

4. Quick Check:

   changeOrigin fixes Host header issues [OK]

Hint: Add changeOrigin: true to fix backend rejection [OK]

Common Mistakes:

• Ignoring changeOrigin option
• Assuming wrong target URL without checking
• Thinking app.listen is missing

5. You want to design an Express API gateway that routes requests to multiple backend services and also logs each request's method and URL. Which approach best fits this requirement?

hard

A. Use only express.static() to serve all backend services and log requests.

B. Use http-proxy-middleware for routing and add a custom middleware before it to log requests.

C. Implement routing logic inside each backend service and skip the gateway.

D. Use body-parser middleware to route and log requests.

Solution

1. Step 1: Identify routing and logging needs

   The API gateway must route requests to multiple backends and log method and URL of each request.

2. Step 2: Choose appropriate middleware

   http-proxy-middleware handles routing, and a custom Express middleware can log requests before proxying.

3. Step 3: Eliminate incorrect options

   express.static() serves static files only, backend routing skips gateway, and body-parser parses bodies but does not route or log.

4. Final Answer:

   Use http-proxy-middleware for routing and add a custom middleware before it to log requests. -> Option B

5. Quick Check:

   Proxy + custom middleware = routing + logging [OK]

Hint: Log requests before proxying with custom middleware [OK]

Common Mistakes:

• Using express.static() for routing
• Skipping gateway for routing
• Confusing body-parser with routing