API Gateway Patterns Cheat Sheet

Architectural patterns for API gateways covering routing, rate limiting, authentication, and request aggregation.

2 PagesIntermediateJan 25, 2026

Common Gateway Responsibilities

Cross-cutting concerns typically centralized in an API gateway.

Routing- Directs requests to the correct backend service by path, host, or header
Authentication/Authorization- Validates API keys, JWTs, or OAuth tokens before forwarding requests
Rate limiting / throttling- Enforces per-client request quotas to protect backends
Request/response transformation- Rewrites headers, bodies, or protocols (e.g. REST to gRPC)
Observability- Centralizes access logs, tracing, and metrics for all API traffic

Kong Route + Rate Limiting Plugin

Declarative Kong config defining a service, route, and rate-limit plugin.

yaml

services:  - name: users-service    url: http://users.internal:8080    routes:      - name: users-route        paths:          - /api/users    plugins:      - name: rate-limiting        config:          minute: 100          policy: local

JWT Validation at the Gateway

Example gateway-level auth config validating a bearer JWT before proxying.

yaml

plugins:  - name: jwt    config:      claims_to_verify:        - exp      key_claim_name: iss      secret_is_base64: false

API Gateway Design Patterns

Higher-level architectural patterns built on top of a gateway.

BFF (Backend for Frontend)- A dedicated gateway per client type (web, mobile) tailored to its needs
Aggregation- Gateway fans out to multiple services and composes a single response
Circuit breaking- Gateway stops forwarding to a failing backend after a failure threshold, failing fast
Canary/blue-green routing- Gateway shifts traffic percentages between backend versions

Pro Tip

Keep the gateway thin on business logic — it should handle cross-cutting concerns (auth, rate limiting, routing) only, otherwise it becomes a shared bottleneck that every team must coordinate through to ship.

Was this cheat sheet helpful?

Service Mesh (Istio) Cheat Sheet

Load Testing (JMeter/k6) Cheat Sheet

Explore Topics

#APIGatewayPatterns#APIGatewayPatternsCheatSheet#DevOps#Intermediate#CommonGatewayResponsibilities#Kong#Route#Rate#Security#APIs#CheatSheet#SkillVeris

Sri Hayavadhana Info-Tech

Professional Web Designing Services