# What is an API Gateway?

> An API gateway is a managed entry point in front of APIs — routing requests, enforcing authentication, rate limits, and policy, and unifying how clients reach backend services.

- Canonical URL: https://yellowcube.eu/glossary/application-programming-interface-gateway/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Rather than exposing services directly, organizations place a gateway at the edge: it terminates connections, validates tokens and keys, applies quotas and throttling, transforms requests, and produces telemetry. In microservice and cloud architectures it becomes a policy enforcement point for east-west and north-south API traffic.

### Key points

- **Consistent edge policy:** Authentication, authorization scopes, schema validation, rate limits, and logging belong at the gateway rather than being reimplemented per service.
- **High-value infrastructure:** It sees every request and holds keys — protect its administrative plane, patch it, and monitor it like an identity system.
- **Important limitation:** A gateway routes and filters; it does not make the API secure. Authorization logic flaws, excessive data exposure, and backend trust of gateway-forwarded requests remain behind the gateway — and a misconfigured gateway is a single point of failure for every API it serves.

### Related terms

[Application programming interface (API) security](<https://yellowcube.eu/glossary/application-programming-interface-security/>) · [Reverse proxy](<https://yellowcube.eu/glossary/reverse-proxy/>) · [API key](<https://yellowcube.eu/glossary/api-key/>) · [Web application firewall (WAF)](<https://yellowcube.eu/glossary/web-application-firewall/>) · [Microsegmentation](<https://yellowcube.eu/glossary/microsegmentation/>)

### Sources

[OWASP, API Security Top 10](https://owasp.org/www-project-api-security/) · [NIST SP 800-204C, Implementation of DevSecOps for a Microservices-based Application with Service Mesh](https://csrc.nist.gov/pubs/sp/800/204/c/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.