What is an API gateway and why is it needed?

The hotel front desk#

We’ll use one analogy. Picture a hotel. Guests don’t wander the corridors trying room doors. They go to the front desk, which checks their booking and ID, hands them the right key, points them to the right floor, and keeps a log of who came and went. If a tour bus of 200 people arrives at once, the desk staggers check-ins so the lifts don’t jam.

The rooms are your back-end services: the order system, the customer database, the inventory app. The front desk is the API gateway. Without it, every room would need its own lock, its own guest list and its own logbook, and each would do it slightly differently.

What it sits between#

1
  Mobile app     Partner system     Website
2
       \               |              /
3
        \              |             /
4
         v             v            v
5
      +----------------------------------+
6
      |           API GATEWAY            |
7
      |  - who are you? (authentication) |
8
      |  - are you allowed? (authorization)
9
      |  - too many requests? (limits)   |
10
      |  - log it, route it              |
11
      +----------------------------------+
12
         |             |             |
13
         v             v             v
14
     Orders API   Customers API  Inventory API

Every caller talks to one address. The gateway decides which service behind it handles each request.

What an API gateway actually does#

Cloud providers describe these products in similar terms. Amazon’s documentation calls Amazon API Gateway a service for creating, publishing, maintaining, monitoring and securing APIs. Microsoft’s Azure API Management overview splits its product into three parts: the gateway itself, a management plane for configuring it, and a developer portal where outside developers read documentation and get keys.

The common jobs are:

• Authentication and authorization. Confirm who’s calling and what they’re allowed to touch, in one place instead of in every service. If your company uses SSO (single sign-on, one login for many apps), the gateway is often where the API side of that check happens. We’ll leave the security set-up itself to specialists.
• Rate limiting. Cap how many requests each caller can make, so one partner’s runaway script can’t slow everyone down.
• Routing. Send /orders to the order service and /customers to the customer service, even if those live on different servers or clouds.
• Logging and monitoring. Record every request so you can see usage, spot errors and bill partners if you charge for access.
• Translation. Reshape requests and responses, for example letting an older partner keep using an old format while the service behind moves on.

Why it’s needed#

The short answer is consistency. Once a company has more than a handful of APIs, or opens them to partners and customers, doing the same checks inside every service gets expensive and uneven. One team forgets to add a limit; another logs in a different format. A gateway puts those rules in one place, so a change (a new partner, a stricter limit) happens once.

There’s a second reason: it hides the back end. Callers only ever see the gateway’s address. You can split one service into two, move it to a different cloud, or replace it, and outside callers don’t notice.

When you can skip it#

If your company consumes other vendors’ APIs but doesn’t publish its own, you don’t need an API gateway. The vendors you call run theirs. Connecting your own tools to each other is a different problem, usually solved with an integration platform or middleware. And if a developer is calling a vendor through a code library, see API vs SDK for how those pieces relate.

What this means for a 20-person company

• If you only connect SaaS tools together, you almost certainly don’t need a gateway.
• If you’re building a customer-facing app or a partner API, ask your developer or agency which gateway they’ll put in front of it.
• Cloud gateway services are priced by request volume or by capacity tier, so ask for an estimate based on your expected traffic.
• Make sure gateway logs go somewhere a named person actually checks.