API Gateway
Overview
An API gateway is a single entry point that sits in front of backend services and routes each incoming request to the right service while handling cross-cutting concerns. Service discovery is the mechanism that lets callers find the current network location of those services as instances start, stop, and move.
Key Concepts
An API gateway is the single entry point for client traffic into a system of services. Beyond routing a request to the correct upstream service, it centralizes cross-cutting concerns so each service does not reimplement them: authentication, TLS termination, rate limiting, request and response transformation, protocol translation, caching, and response aggregation. It differs from a plain load balancer, which spreads connections across interchangeable instances; a gateway makes application-aware routing decisions and can rewrite requests.
Service discovery keeps track of which service instances are healthy and where they live. Instances register with a service registry on startup and send heartbeats; callers consult the registry instead of using fixed addresses. There are two models: in client-side discovery the caller queries the registry and picks an instance itself, while in server-side discovery the caller sends the request to a router that consults the registry on its behalf.
| Aspect | Client-side discovery | Server-side discovery |
|---|---|---|
| Who queries the registry | The caller | A router, gateway, or load balancer |
| Load-balancing logic | Lives in the client | Lives in the router |
| Client complexity | Higher (registry-aware client) | Lower (client hits one address) |
| Extra network hop | No | Yes (through the router) |
| Example | Netflix Eureka + Ribbon | Kubernetes Service, AWS ALB |
Trade-offs
The gateway is a natural chokepoint: it can become a single point of failure and adds a latency hop, so it is run as a replicated, horizontally scaled tier. Centralizing cross-cutting concerns keeps services thin, but it risks turning the gateway into a bloated monolith of its own if business logic leaks into it. For discovery, client-side avoids the extra hop but couples every caller to the registry and often to one language's client library; server-side hides discovery behind a router at the cost of that hop and an extra component to operate.
Interview Tips
- Draw the gateway as the single front door, then list the cross-cutting concerns you are offloading to it.
- Call out explicitly that it must be replicated so it is not a single point of failure.
- When asked how services find each other, name the registry and state whether discovery is client-side or server-side and why you chose that model.
Summary
- An API gateway is the single entry point that routes requests and centralizes cross-cutting concerns like authentication and rate limiting.
- A gateway is application-aware and does more than a load balancer, which simply spreads connections.
- Service discovery uses a registry so callers find healthy instances without hardcoded addresses.
- Client-side discovery puts routing logic in the caller; server-side hides it behind a router at the cost of a hop.
- Replicate the gateway and registry so neither becomes a single point of failure.