Cybersecurity glossary
What is an API Gateway?
Learn what an API gateway is, how it centralizes routing authentication rate limits and observability for microservices, and which security responsibilities it should and should not own alone.
Definition
An API gateway is an entry-point service that sits in front of backend APIs to handle cross-cutting concerns such as routing, authentication and authorization checks, rate limiting, TLS termination, request transformation, and centralized telemetry for client traffic.
Why API gateways matter
As systems split into many services, clients should not need a map of every internal hostname. An API gateway provides one managed entry point where routing and shared controls live.
For security teams, the gateway is leverage: authenticate once at the edge, apply consistent rate limits, and emit uniform telemetry. It is not, however, a substitute for service-owned authorization.
What gateways typically do
Routing and composition
Map external paths to upstream services, versions, and canary pools.
Identity at the edge
Validate API keys, mTLS, or bearer tokens before traffic reaches backends.
Traffic policy
Enforce rate limits, payload size caps, IP allowlists, and timeouts.
Observability
Centralize request logs, metrics, and traces for north-south API traffic.
Request path through a gateway
Client hits the gateway
TLS is terminated and the external route is matched.
Policy checks run
Authn, coarse authz, rate limits, and schema/size guards execute.
Request is transformed
Headers may be normalized; identity context is attached for upstreams.
Upstream service is called
Gateway proxies to the selected backend instance or cluster.
Service enforces deep authz
Object- and business-level authorization still happens in the service.
Response returns via the edge
Errors are shaped, sensitive headers stripped, and metrics emitted.
Gateway vs related components
| Component | Primary job | Security role |
|---|---|---|
| API gateway | API-aware edge entry | Authn, rate limits, routing policy |
| Load balancer | Distribute connections | Basic network health and TLS |
| WAF | Filter exploit payloads | Signature/behavior web attack defense |
| Service mesh | East-west service traffic | mTLS, retries, identity between services |
Gateway security checklist
- Require authentication on every external route by default; deny unmarked routes.
- Keep object-level authorization in owning services—not only at the gateway.
- Inventory all published routes to prevent shadow and zombie endpoints.
- Apply per-route and per-identity rate limits plus payload ceilings.
- Propagate verified identity inward; do not trust client-supplied user headers alone.
- Segment admin gateway routes from public API entry points.
- Design for gateway HA so the security edge is not a brittle SPOF.
- Continuously test that bypass paths cannot reach backends directly from the internet.
The practical takeaway
An API gateway centralizes how clients reach your APIs and how shared edge controls are applied. Use it for consistent authentication, throttling, and telemetry—then keep deep authorization next to the data.
Treat unregistered gateway routes and direct-to-service exposure as first-class security bugs.
Related security terms
Reverse Proxy
Infrastructure pattern many gateways build on for inbound traffic.
Rate Limiting
A common gateway-enforced control against abusive request volume.
Access Token
Credential often validated or introspected at the gateway.
Service Mesh
Complements gateways by securing east-west service traffic.
API Abuse
Hostile or unintended API use gateways help detect and slow.
Frequently asked questions
What is an API gateway in simple terms?
It is the front door for your APIs. Clients talk to the gateway, and the gateway routes each request to the right backend while applying shared security and traffic rules.
How is an API gateway different from a load balancer?
Load balancers primarily distribute traffic. API gateways add API-aware features such as authn/authz hooks, per-route rate limits, schema checks, and request/response transformation.
Should the gateway be the only authorization layer?
No. Gateways are excellent for coarse checks, but object-level and business authorization must still run in the services that own the data.
Does a gateway replace a WAF?
Not fully. Some gateways include WAF-like features, but many organizations run both: WAF for web exploit filtering and gateway for API policy.
What traffic does an API gateway usually handle?
Primarily north-south traffic from external clients into the platform. East-west service-to-service calls are often handled by a mesh or internal gateways.
Can gateways validate JWTs?
Yes, many terminate bearer JWT validation at the edge, then pass identity context to backends over trusted internal channels.
What are common gateway risks?
Misrouted shadow endpoints, overly trusted internal networks, skipped auth on some routes, and central outages if the gateway becomes a single point of failure.
References
Explore authoritative guidance and frameworks related to api gateway.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.