API Gateway

Problem

Your public application contains 40 backend APIs. Clients shouldn't need to know: orders.internal:8082 users.internal:7412 payments.internal:9011 And every API shouldn't independently implement the same external policies.

Solution — API Gateway

Expose one controlled entry point.

Clients
   ↓
API Gateway
 → Orders
 → Users
 └→ Payments

Both an API gateway and a Layer 7 load balancer can route by path, such as /orders. The gateway focuses on API policies such as token validation, quotas, and request transformation; the load balancer distributes traffic across healthy instances. They can work together: Client → API Gateway → Load Balancer → API instances. Some products combine both roles.

Core idea: an API gateway centralizes external API entry and cross-cutting policies.