What is an API gateway? Meaning, functions and examples

Think of the reception desk of a large office building. Visitors do not walk straight to the floor they want: they stop at one desk, show who they are, and are sent to the right place. Nobody has to post a guard on each floor. An API gateway does the same for software. A mobile app, a website, a partner's system or another internal application sends its request to one address, and the gateway works out which service should answer it.

A load balancer answers "which copy of this service should take the request?". An API gateway answers "may this caller make this request, and which service should handle it?". The two overlap, since many gateways balance load and many load balancers read paths. The difference is the consumer: a gateway knows this call comes from a specific partner with a specific limit; a load balancer generally does not.

A service mesh places a small proxy beside each service so that calls between services are encrypted, retried and measured in the same way, without changing the services' code. It is aimed at traffic inside the platform. A gateway is aimed at the front door. A handful of services rarely needs a mesh; many services on Kubernetes may justify both. The service mesh page covers when a mesh is worth its operating cost.

Relatedservice mesh page

• A mobile app back end: the app calls one address; the gateway checks the user's token and sends each call to the accounts, orders or payments service.
• Partner and open banking APIs: each partner gets its own credentials and limits. Interkey's open banking page covers that case.
• Microservices: dozens of small services share one place for authentication and limits.
• AI traffic: calls to language models pass a gateway that applies token budgets and prompt rules, described on the Kong AI Gateway page.

Relatedopen banking pageKong AI Gateway page

A single application calling a single service, with no outside consumers, may not need a gateway yet. And a gateway cannot make an unsafe service safe: weak authorisation inside a service, responses that return too much data and unpatched dependencies still have to be fixed in the service. Listing your APIs and writing down who may call what usually comes before choosing a product; that work is API management, and the gateway is where it is enforced.

Interkey implements Kong Gateway, a product of Kong Inc., one of Interkey's technology partners. Kong documents three ways to run it: traditional, with a database; DB-less, with configuration loaded from a declarative file; and hybrid, with a control plane that holds configuration and data planes that carry traffic. Some plugins are Enterprise only, so the edition follows the functions you need.

Interkey designs the gateway, writes its policies as version-controlled configuration, connects it to your identity and monitoring platforms and operates it afterwards. The API gateway page sets out the deployment shapes and a requirements checklist you can use to judge any proposal, including ours.

For organisations in the Kingdom the first design question is usually where the gateway runs, because the part that inspects payloads runs wherever the traffic flows. If payloads may not leave Saudi Arabia, that part must run in the Kingdom too; with a self-managed deployment, both the traffic plane and the configuration plane can run on infrastructure you operate locally. Interkey's engineers support the gateway from Riyadh, in Arabic and English, and test Arabic and mixed-script payloads.