API Gateway

An API gateway earns its place by centralizing the things every backend would otherwise reimplement badly: authentication, rate limiting, and a stable external contract in front of services that change internally all the time. It only pays for itself when it stays a thin, well-understood layer — the moment it accumulates business logic, it becomes a second application nobody wants to own, deployed on a critical path everything else depends on.

The gateway is infrastructure, not a place to write features. Every rule it enforces should be cross-cutting; anything specific to one backend belongs in that backend.

1. Route by contract, not by convenience

The gateway's routing table is the external API's actual shape — clients depend on it staying stable even as internal services are renamed, split, or replaced behind it. Decide routing rules (path, host, header) up front as a deliberate contract, not as whatever happened to match during initial setup, because changing that contract later is a breaking change for every client.