Design an API Gateway
MediumSystem design · Platform
Design an API gateway for a microservices platform. All external client requests (web, mobile, partners) enter through it and are routed to the correct backend service.
In scope: routing, authentication, rate limiting, resilience (timeouts, retries, circuit breaking), config rollout, and observability. Out of scope: internal service-to-service traffic (service mesh) and business logic or response aggregation.
Requirements
- Route requests by path, host, version, or tenant using a route table held in memory
- Enforce authentication, authorization scopes and rate limits at the edge without per-request network calls
- Provide observability without becoming a single point of failure; keep serving on last-known-good config
- Roll out config and route changes safely with canaries; retries must not amplify an outage