What does an API gateway do in a microservice system?
An API gateway is the single entry point for clients. It routes requests to the right service and handles shared concerns such as authentication, rate limiting, TLS and logging, so each service does not repeat them.
Explain it simply
A mobile app talking directly to twenty microservices would need twenty addresses and each service would repeat login checks. An API gateway is the reception desk of the system: clients talk only to it.
What it typically does:
- Routing: /orders goes to the order service, /users to the user service.
- Authentication and authorization: verify the token once at the edge.
- Rate limiting and quotas per client.
- TLS termination, compression, request and response logging.
- Aggregation: combine several service calls into one response, which saves mobile data.
- Protocol translation, for example public REST to internal gRPC.
Costs: it is another hop, so latency adds a little, and it can become a bottleneck or single point of failure, so run several copies. Keep business logic out of it, or it turns into a hidden monolith.
Example
A request to fetch the home screen:
App -> Gateway: GET /home (token verified, rate limit checked)
Gateway -> user-service: GET /profile
Gateway -> order-service: GET /recent-orders
Gateway -> offers-service: GET /offers
Gateway -> App: one combined JSON responseWhat to say in the interview
"The gateway is the single front door: routing, auth, rate limiting, TLS and aggregation in one place. I run it redundantly and keep business rules out of it, so it stays a thin layer rather than a bottleneck."