api-gateway-patterns

API Gateway Patterns

When to Use

• Designing an API gateway for microservices
• Implementing rate limiting, authentication, or request routing
• Evaluating BFF (Backend for Frontend) pattern
• Adding circuit breaking to external service calls

Gateway Architecture

                    ┌─────────────────────┐
                    │    API Gateway       │
                    │                     │
  Clients ────────►│  1. Rate Limiting    │
                    │  2. Authentication   │
                    │  3. Request Routing  │
                    │  4. Load Balancing   │
                    │  5. Circuit Breaking │
                    │  6. Response Caching │
                    │  7. Logging/Tracing  │
                    └────┬────┬────┬──────┘
                         │    │    │
                    ┌────┘    │    └────┐
                    ▼         ▼         ▼
              ┌──────┐  ┌──────┐  ┌──────┐
              │Svc A │  │Svc B │  │Svc C │
              └──────┘  └──────┘  └──────┘

Rate Limiting Patterns

Token Bucket (recommended)

// Allows burst then throttles
const rateLimiter = {
  bucketSize: 100,      // Max tokens
  refillRate: 10,       // Tokens per second
  refillInterval: 1000, // ms
};
// Burst: 100 requests instantly, then 10/sec sustained

Sliding Window

// More accurate, no burst
// Count requests in last N seconds
// Redis implementation:
// ZADD rate:{userId} {timestamp} {requestId}
// ZREMRANGEBYSCORE rate:{userId} 0 {timestamp - window}
// ZCARD rate:{userId}

Rate Limit by Tier

Tier	Rate Limit	Burst
Free	100 req/hour	10 req/sec
Basic	1000 req/hour	50 req/sec
Pro	10000 req/hour	200 req/sec
Enterprise	Custom	Custom

Response Headers

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 42
X-RateLimit-Reset: 1619472000
Retry-After: 60

API Versioning Strategies

Strategy	Example	Pros	Cons
URL path	/v1/users	Simple, clear	URL pollution
Header	Accept: application/vnd.api.v1+json	Clean URLs	Hidden, harder to test
Query param	/users?version=1	Easy to switch	Messy