An API gateway is a single entry point in front of many backend services.
What it does:
- Routing - maps a path such as /orders to the order service.
- Authentication and authorisation - validates the token once, so services do not each reimplement it.
- Rate limiting and quotas - per user or per API key, protecting backends from abuse.
- TLS termination - one place to manage certificates.
- Request and response transformation - protocol translation, such as REST at the edge to gRPC internally.
- Aggregation - fan out to several services and compose one response, reducing mobile round trips.
- Observability - one place for logging, metrics and trace ID injection.
The risk: it becomes a single point of failure and a deployment bottleneck if business logic creeps into it. Keep it thin, run several replicas behind a load balancer, and avoid putting domain logic there.
Related pattern: Backend for Frontend (BFF) - a separate gateway per client type, so the mobile app gets a slim payload while the web app gets a richer one.