advanced

API gateway

Centralize edge routing, auth enforcement, rate limits, and aggregation carefully so the gateway does not become a hidden monolith.

An API gateway is the single entry for external clients: TLS termination, authentication, rate limiting, routing, and sometimes response aggregation. It simplifies client contracts but can become a bottleneck and a hidden monolith if business logic accumulates.

Trade-off: centralized cross-cutting policies versus team autonomy and gateway release risk.

On interviews: what belongs in the gateway versus BFF versus domain service; prevent gateway bloat.

Common pitfalls: orchestration workflows in the gateway; no per-route timeouts; one gateway team blocking all product releases.

Checklist:

Keep domain logic in services, policy at the edge.
Per-route auth, limits, and timeouts.
Avoid shared mutable state in gateway.
Split edge gateways per client type if needed.