API Gateway pattern in Microservices - System Design Guide

Problem Statement

When multiple microservices serve different parts of an application, clients must call each service separately. This leads to complex client logic, increased network calls, and difficulty managing cross-cutting concerns like authentication and rate limiting.

Solution

An API Gateway acts as a single entry point for all client requests. It routes requests to the appropriate microservices, aggregates responses if needed, and handles common tasks like authentication, logging, and throttling centrally. This simplifies client interactions and centralizes control.

Architecture

Client

↓

API Gateway

┌─────────┐

↓

Microservice 1

This diagram shows the client sending requests to the API Gateway, which handles authentication and rate limiting before routing requests to the appropriate microservices.

Trade-offs

✓ Pros

→

Simplifies client by providing a single endpoint for all services.

→

Centralizes cross-cutting concerns like authentication, logging, and rate limiting.

→

Enables response aggregation to reduce client network calls.

→

Allows independent evolution of backend services without impacting clients.

✗ Cons

→

Introduces a single point of failure if the gateway is not highly available.

→

Can become a performance bottleneck under heavy load without proper scaling.

→

Adds complexity to deployment and maintenance of the gateway component.

Use when you have multiple microservices and want to simplify client interactions, especially if clients are diverse (web, mobile) or you need centralized security and monitoring.

Avoid when your system has only a few services or very simple interactions, as the added gateway layer may increase latency and complexity unnecessarily.

Real World Examples

Netflix

Netflix uses an API Gateway to route client requests to various backend services and to handle authentication and request throttling centrally.

Amazon

Amazon employs API Gateways to provide a unified interface for its diverse microservices, simplifying client access and managing security policies.

Uber

Uber uses API Gateways to aggregate data from multiple microservices, reducing the number of client calls and improving mobile app performance.

Code Example

The before code shows the client calling multiple services directly, increasing complexity and network calls. The after code shows the client calling a single API Gateway endpoint, which aggregates data from multiple services and returns a combined response, simplifying the client logic.

Microservices

### Before: Client calls multiple services directly
import requests

def get_user_profile(user_id):
    user_resp = requests.get(f'http://user-service/users/{user_id}')
    orders_resp = requests.get(f'http://order-service/orders?user={user_id}')
    return {
        'user': user_resp.json(),
        'orders': orders_resp.json()
    }


### After: Client calls API Gateway once
import requests

def get_user_profile(user_id):
    resp = requests.get(f'http://api-gateway/profile/{user_id}')
    return resp.json()


# API Gateway routing example (simplified)
from flask import Flask, request, jsonify
import requests

app = Flask(__name__)

@app.route('/profile/<user_id>')
def profile(user_id):
    # Authentication and rate limiting would happen here
    user_resp = requests.get(f'http://user-service/users/{user_id}')
    orders_resp = requests.get(f'http://order-service/orders?user={user_id}')
    combined = {
        'user': user_resp.json(),
        'orders': orders_resp.json()
    }
    return jsonify(combined)

Alternatives

Client-side Aggregation

Clients call multiple services directly and aggregate responses themselves.

Use when: Choose when clients are trusted, have sufficient resources, and the number of services is small.

Backend for Frontend (BFF)

Separate gateways are created for different client types (e.g., mobile, web) to tailor APIs specifically.

Use when: Choose when different clients have very different needs and require customized APIs.

Summary

API Gateway provides a single entry point to multiple microservices, simplifying client interactions.

It centralizes cross-cutting concerns like authentication, logging, and rate limiting.

While it adds a layer of complexity, it improves maintainability and scalability for complex systems.