The API Gateway: One Front Door for a Hundred Services

Open the network tab on a mobile app’s home screen. One tap to open the app, and it fires twelve requests: profile from the user service, the cart from checkout, recent orders from fulfillment, recommendations from ranking, unread count from notifications, a feature-flag blob from config, and on and on. Each call carries its own auth header. Each service parses that token itself, decides its own CORS policy, runs its own rate limiter — twelve times, twelve slightly different implementations, twelve places a bug in token handling can hide.

The client is now coupled to your entire service topology. Split the order service in two and the app has to learn two new hostnames and ship an update. A junior team stands up a new service and forgets to rate-limit it — now it’s a DDoS amplifier pointed at your own database. The chattiness is a battery-and-latency tax on every mobile user, and the security surface is smeared across every team.

The fix isn’t a smarter client. It’s a single door.

The intuition: the front desk of a large building

You don’t walk into a corporate tower and wander to whichever floor you need, badging in at each office door. You stop at the front desk. It checks your ID once, issues a visitor pass, tells you the accounting team moved to the 9th floor, and logs that you came through. The offices upstairs trust the pass and get on with their work — none of them runs its own ID check.

The gateway is that front desk. Clients present credentials once; the gateway verifies them, stamps a trusted internal header, and forwards the request to whichever service owns the work. The services behind it stop re-implementing the lobby.

From here the members-only walkthrough builds the whole edge: the request pipeline with the code that declares auth, rate limiting, and routing once; the aggregation move that collapses a screen’s twelve calls into one parallel fan-out; the gateway-vs-BFF and gateway-vs-mesh distinctions; the two ways it goes wrong (SPOF and the distributed monolith); real-world gateways in the wild; and an interview corner with a food-delivery edge-design challenge and a quiz.