Platform category · 2 min read
API gateways
Neutral overview. Twobo Technologies is not affiliated with, sponsored by or a reseller for Broadcom (Layer7), or any API gateway vendor or any other vendor. Product names belong to their owners; check the vendor's own documentation for current editions and licensing.
Short answer
An API gateway is a reverse proxy in front of your APIs that centralizes cross-cutting controls: it validates OAuth access tokens, enforces rate limits and quotas, checks request schemas, terminates TLS or mTLS, routes and transforms requests, and records traffic, while object-level authorization stays in the services.
Key takeaways
- Gateways are the right place for coarse checks; business authorization stays in the service.
- A gateway is not an authorization server; it consumes tokens that the authorization server issues.
- Choose by deployment model, protocol support, policy language and how changes are managed as code.
An API gateway is the front door for your APIs. Every request passes through it, so it is the natural place for controls that apply to all of them. It is also easy to expect too much from it.
What does a gateway do?
Authentication of callers, traffic control, input checks, routing and observability.
| Function | Example |
|---|---|
| Token validation | Verify JWT signature, iss, aud, exp, scopes; or introspect opaque tokens (RFC 7662) |
| Client authentication | API keys for identification, mTLS for strong client identity |
| Traffic control | Rate limits, quotas, spike arrest, payload size limits |
| Input validation | JSON schema or OpenAPI validation, header rules |
| Routing and transformation | Versioning, protocol translation (REST to SOAP), header injection |
| Observability | Access logs, metrics, tracing |
Decode a token that your gateway accepts with the JWT Decoder and confirm the gateway checks what you think it checks, especially aud.
What should a gateway not do?
Make business authorization decisions that need your data.
The gateway can confirm a token has accounts:read. It cannot know whether account 4712 belongs to this user. Keep object- and property-level checks in the service, as described in the OWASP API Top 10 article.
How does it relate to the authorization server?
The authorization server issues tokens; the gateway consumes and enforces them.
Some products bundle both. Keeping the roles distinct in your design makes it easier to replace either.
How do I choose one?
Start from where your APIs run and how your team manages configuration.
- Deployment: managed cloud, self-hosted, hybrid, Kubernetes ingress.
- Protocols: REST, GraphQL, gRPC, WebSockets, SOAP if you still have it.
- Security features: JWT and introspection, mTLS, DPoP support, OpenAPI validation.
- Policy as code: can configuration live in version control and go through review?
- Developer portal: needed for external API programs.
- Cost model: per call, per instance or per environment.
Broadcom's Layer7 API Gateway, originally from Layer 7 Technologies (acquired by CA Technologies in 2013, which Broadcom acquired in 2018), is one long-standing enterprise option; many cloud and open-source options exist. Evaluate against your own scenarios.
Questions
Do I need an API gateway if I use a service mesh?
They overlap for internal traffic: a mesh handles service-to-service mTLS and routing. A gateway is still typical at the edge, for external clients, developer keys, quotas and OAuth token validation.
Which gateways are common?
Options include cloud-native gateways from AWS, Azure and Google Cloud (Apigee), open-source projects such as Kong and Envoy-based gateways, and enterprise products such as Broadcom's Layer7 API Gateway. Fit depends on where your APIs run.