API Gateway Patterns: Kong, AWS API Gateway & Nginx Guide

An API gateway is the front door to your microservices architecture. It centralizes authentication, rate limiting, routing, SSL termination, and observability so backend services stay focused on business logic. This guide covers the core patterns and tool choices.

Rate Limiting with Kong

Kong plugins are applied to services or routes. The rate-limiting plugin protects a service with per-consumer limits using a sliding window algorithm:

# Declarative Kong configuration (deck / kong.yaml)
services:
  - name: user-service
    url: http://user-service:8080
    routes:
      - name: user-api-route
        paths:
          - /api/v1/users
        methods: [GET, POST, PUT, DELETE]

plugins:
  # Rate limiting: 100 req/minute per consumer
  - name: rate-limiting
    service: user-service
    config:
      minute: 100
      hour: 1000
      policy: redis          # Store counters in Redis for distributed deployments
      redis_host: redis
      redis_port: 6379
      fault_tolerant: true   # Allow requests if Redis is unavailable
      hide_client_headers: false

  # JWT authentication before routing
  - name: jwt
    service: user-service
    config:
      claims_to_verify: [exp]
      key_claim_name: iss

Auth Middleware Pattern (Express Gateway / Custom)

When building a lightweight custom gateway in Node.js, centralize JWT validation in middleware before proxying to upstream services:

import express from 'express';
import { createProxyMiddleware } from 'http-proxy-middleware';
import jwt from 'jsonwebtoken';

const app = express();

// Auth middleware — validates JWT and injects user context
function authMiddleware(req: any, res: any, next: any) {
  const token = req.headers.authorization?.replace('Bearer ', '');
  if (!token) return res.status(401).json({ error: 'Missing token' });

  try {
    const payload = jwt.verify(token, process.env.JWT_SECRET!) as any;
    req.headers['x-user-id'] = payload.sub;
    req.headers['x-user-roles'] = payload.roles?.join(',') ?? '';
    next();
  } catch {
    res.status(401).json({ error: 'Invalid token' });
  }
}

// Route to user service — protected
app.use('/api/v1/users', authMiddleware, createProxyMiddleware({
  target: 'http://user-service:8080',
  changeOrigin: true,
}));

// Route to public service — no auth
app.use('/api/v1/products', createProxyMiddleware({
  target: 'http://product-service:8081',
  changeOrigin: true,
}));

Nginx Rate Limiting & Routing

Nginx provides high-performance rate limiting and upstream routing with minimal configuration overhead:

# nginx.conf — API gateway configuration
http {
  # Define rate limiting zone: 10 MB memory, 10 req/sec per IP
  limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;

  upstream user_service   { server user-service:8080; }
  upstream order_service  { server order-service:8082; }
  upstream product_service { server product-service:8081; }

  server {
    listen 80;

    location /api/v1/users {
      limit_req zone=api burst=20 nodelay;
      limit_req_status 429;
      proxy_pass http://user_service;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header Authorization $http_authorization;
    }

    location /api/v1/orders {
      limit_req zone=api burst=10 nodelay;
      proxy_pass http://order_service;
    }

    location /api/v1/products {
      # Public endpoint — higher limit
      limit_req zone=api burst=50 nodelay;
      proxy_pass http://product_service;
    }
  }
}

Kong vs AWS API Gateway vs Nginx