API Gateway adalah pintu masuk tunggal (single entry point) untuk semua API request dari client ke backend services.

Tanpa API Gateway:

Client harus tahu alamat setiap service:
Mobile App → https://auth.example.com/login
           → https://users.example.com/profile
           → https://orders.example.com/history
           → https://payments.example.com/balance

Masalah: client harus tahu banyak URL, setiap service harus handle auth sendiri, sulit menambah rate limiting secara konsisten.

Dengan API Gateway:

Client → API Gateway (satu URL) → Auth Service
       https://api.example.com   → User Service
                                 → Order Service
                                 → Payment Service

Fungsi API Gateway:

1. Routing — arahkan request ke service yang tepat:

GET  /api/users/*     → User Service
POST /api/orders/*    → Order Service
GET  /api/payments/*  → Payment Service

2. Authentication — verifikasi di satu tempat:

// Semua request divalidasi di gateway
app.use("/api/*", async (req, res, next) => {
  const token = req.headers.authorization;
  const user = await verifyToken(token);
  if (!user) return res.status(401).json({ error: "Unauthorized" });
  req.user = user;
  next();
});

3. Rate Limiting — batasi request per user/IP:

// Max 100 request per menit per user
const limiter = rateLimit({
  windowMs: 60 * 1000,
  max: 100,
  keyGenerator: (req) => req.user?.id || req.ip
});

4. Request Aggregation — gabungkan beberapa API call:

// Client butuh data dari 3 service
// Tanpa gateway: client harus 3x request
// Dengan gateway: 1 request, gateway yang menggabungkan

app.get("/api/dashboard", async (req, res) => {
  const [user, orders, notifications] = await Promise.all([
    fetch("http://user-service/user/" + req.user.id),
    fetch("http://order-service/orders?userId=" + req.user.id),
    fetch("http://notification-service/unread?userId=" + req.user.id)
  ]);

  res.json({
    user: await user.json(),
    recentOrders: await orders.json(),
    notifications: await notifications.json()
  });
});

5. Caching — cache response yang sering diminta: 6. Logging & Monitoring — catat semua request di satu tempat 7. SSL Termination — handle HTTPS di gateway 8. Request/Response Transformation:

// Transform response dari service internal ke format yang sesuai client
app.get("/api/v2/users/:id", async (req, res) => {
  const internal = await fetch("http://user-service/user/" + req.params.id);
  const data = await internal.json();

  // Transform untuk API v2
  res.json({
    id: data.user_id,
    fullName: data.first_name + " " + data.last_name,
    avatar: data.profile_image_url
  });
});

API Gateway populer:

Hati-hati: API Gateway bisa menjadi single point of failure dan bottleneck. Pastikan gateway di-scale dan di-monitor dengan baik.

🎭 Analogi sehari-hari: Resepsionis hotel besar. Tamu datang, satu tempat. Resepsionis cek ID (auth), arahkan ke kamar yang tepat (routing), kasih kunci (token), batasi tamu nakal (rate limit), catat siapa masuk-keluar (logging). Tanpa resepsionis = tamu ngacir ke kamar manapun = chaos.

💡 API Gateway menyembunyikan kompleksitas internal: Client gak perlu tau ada 50 microservices di belakang. Cukup tau 1 URL api.example.com. Mau migrasi service dari Node ke Go? Client gak perlu tau, gateway handle. Decoupling antara client interface dan service implementation.

⚠️ Jebakan klasik:

• Gateway jadi monolith baru — kalau semua logic taro di gateway, gateway = bottleneck. Jaga gateway tipis, logic di service
• SPOF (single point of failure) — gateway down = semua API down. Wajib redundant + auto-failover
• Latency overhead — extra hop = +5-20ms. Untuk internal service-to-service, bypass gateway
• Vendor lock-in — AWS API Gateway terikat ke AWS. Pilih based on portability needs
• Authentication di gateway tapi authorization di service — gampang miskomunikasi, jelaskan boundary

🎯 API Gateway pattern variant:

• Gateway Aggregation — gabung response dari banyak service jadi 1
• Gateway Routing — basic routing by path/header
• Gateway Offloading — pindahin SSL, auth, rate limit ke gateway
• Backend for Frontend (BFF) — gateway terpisah per client type (mobile, web, third-party)

TL;DR: API Gateway = pintu tunggal untuk client + offload concern lintas-service (auth, rate limit, routing, logging). Wajib di microservices. Awas SPOF + bottleneck. Jaga thin, logic di service. Pertimbangkan BFF untuk client diversity.