API Gateways Are Plenty

A survey of the API gateway landscape — what they do, when you need one, and which options are available.

When you build microservices, every service has its own API. An API gateway sits in front of them all, providing a single entry point for clients. The good news: there are plenty of options. The challenge: choosing the right one.

What Does an API Gateway Do?

An API gateway handles cross-cutting concerns so individual services don’t have to:

• Routing — maps external URLs to internal services
• Authentication / Authorization — validates tokens before forwarding requests
• Rate Limiting — prevents abuse by throttling requests per client
• Load Balancing — distributes traffic across service instances
• Request Transformation — modifies headers, bodies, or protocols
• Circuit Breaking — fails fast when a downstream service is down
• Logging / Metrics — centralizes observability

The Landscape

Kong

Kong is an open-source gateway built on Nginx, with a plugin-based architecture.

Key features:

• Lua plugin system (plus a Go plugin server)
• Database-backed or DB-less (declarative) configuration
• Built-in plugins for auth, rate limiting, logging, and transformations
• Enterprise version with additional plugins and support

When to pick Kong: You want a mature, widely-deployed gateway with a rich plugin ecosystem and don’t mind running Nginx + Lua.

Envoy

Envoy is a high-performance L4/L7 proxy originally built by Lyft. It’s not a full API gateway out of the box — it’s the proxy that gateways are built on.

Key features:

• gRPC, HTTP/2, and WebSocket support
• Advanced load balancing (ring hash, least request, etc.)
• Built-in observability (stats, tracing, logging)
• Dynamic configuration via xDS API

When to pick Envoy: You’re building your own gateway layer, or you’re using a service mesh (Istio uses Envoy as its sidecar proxy).

AWS API Gateway

AWS API Gateway is a fully managed service that integrates directly with AWS Lambda and other AWS services.

Key features:

• No infrastructure to manage
• REST and WebSocket APIs
• Built-in auth via Cognito, Lambda, or IAM
• Usage plans and API keys for monetization

When to pick AWS API Gateway: You’re all-in on AWS and want zero-ops infrastructure.

Tyk

Tyk is an open-source gateway written in Go with a focus on developer experience.

Key features:

• Dashboard and portal (open-source gateway, commercial dashboard)
• GraphQL support
• Plugin system in Python, JavaScript, and Go
• Easy integration with CI/CD pipelines

When to pick Tyk: You want a Go-based gateway with a developer-friendly dashboard.

Traefik

Traefik is a modern reverse proxy and load balancer with automatic service discovery.

Key features:

• Auto-discovery from Docker, Kubernetes, Consul, et al.
• Let’s Encrypt integration for automatic TLS
• Hot-reloading configuration without restarts
• Middleware system for auth, rate limiting, and retries

When to pick Traefik: You’re running containers and want automatic routing with zero config.

Do You Even Need One?

Not every architecture needs a dedicated API gateway. Consider these questions:

• How many services do you have? If it’s fewer than 5, a simple reverse proxy (Nginx, Caddy) may be enough.
• Who are your clients? If it’s internal services only, service mesh (Istio, Linkerd) might be a better fit.
• Do you need rate limiting and auth at the edge? If yes, a gateway saves you from reimplementing this in every service.
• Can your load balancer handle it? Cloud load balancers (AWS ALB, GCP Cloud Load Balancing) now support path-based routing and auth — sometimes that’s sufficient.

Quick Comparison

Bottom Line

Start simple. If you’re running containers, Traefik is hard to beat for automatic routing. If you need a full-featured gateway with auth, rate limiting, and plugins, Kong or Tyk are solid choices. If you’re building a service mesh, Envoy is the foundation. And if you want zero infrastructure management, AWS API Gateway handles it all for you.