API Gateway Patterns: Managing API Complexity

Why API Gateways?

An API gateway provides a single entry point for clients, handling cross-cutting concerns like authentication, rate limiting, and request routing. It simplifies client code and centralizes infrastructure concerns.

Request Aggregation

// Instead of multiple client requests
class DashboardController
{
    public function index(): Response
    {
        // Aggregate multiple service calls
        return response()->json([
            'user' => $this->userService->current(),
            'orders' => $this->orderService->recent(5),
            'notifications' => $this->notificationService->unread(),
            'stats' => $this->analyticsService->summary(),
        ]);
    }
}

Authentication Gateway

class AuthenticationGateway
{
    public function handle(Request $request, Closure $next): Response
    {
        $token = $request->bearerToken();

        if (!$token) {
            return response()->json(['error' => 'Unauthorized'], 401);
        }

        $user = $this->validateToken($token);
        $request->setUserResolver(fn () => $user);

        return $next($request);
    }
}

Rate Limiting

class RateLimitingGateway
{
    public function handle(Request $request, Closure $next): Response
    {
        $key = $this->resolveKey($request);
        $limit = $this->getLimit($request);

        if (!$this->limiter->attempt($key, $limit)) {
            return response()->json([
                'error' => 'Rate limit exceeded',
                'retry_after' => $this->limiter->availableIn($key),
            ], 429);
        }

        return $next($request);
    }
}

Response Transformation

class ResponseTransformer
{
    public function transform(Response $response, string $format): Response
    {
        $data = json_decode($response->getContent(), true);

        return match ($format) {
            'xml' => $this->toXml($data),
            'csv' => $this->toCsv($data),
            default => $response,
        };
    }
}

Conclusion

API gateways centralize cross-cutting concerns and simplify client interactions. Use them for authentication, rate limiting, request aggregation, and response transformation.