How do you implement API gateway patterns for microservices architectures?
API gateways provide a single entry point for external clients to access internal microservices. Core capabilities: request routing (direct requests to appropriate backend services based on path, headers, or content), authentication and authorization (validate tokens, enforce RBAC before requests reach backend services), rate limiting (protect services from abuse with configurable limits per client, endpoint, or tier), and request/response transformation (modify headers, payloads, and formats between client and service). Implementation options: Kong (open source, plugin ecosystem, declarative configuration), AWS API Gateway (fully managed, deep AWS integration), Envoy (high-performance proxy, service mesh compatible), and Traefik (container-native, auto-discovery from Docker/Kubernetes). Patterns: (1) Backend-for-Frontend (BFF): separate API gateways per client type (mobile, web, third-party), each optimizing data shape and performance for its client. (2) API composition: gateway aggregates data from multiple services into a single response, reducing client-side complexity and network calls. (3) Protocol translation: gateway translates between external protocols (REST, GraphQL) and internal protocols (gRPC, message queues). Security: terminate TLS at the gateway, validate JWT tokens and check scopes/permissions, implement CORS policies, sanitize and validate request payloads, and log all API access for audit. Performance: implement response caching at the gateway level (configurable TTL per endpoint), request coalescing (deduplicate identical concurrent requests), and compression (gzip/brotli for response payloads). Observability: collect metrics per endpoint (latency, error rate, throughput), implement distributed tracing header propagation (inject trace IDs), and provide developer-facing analytics dashboards. Developer experience: generate API documentation from OpenAPI specs, implement developer portal with self-service API key management, provide SDKs for common client languages, and implement sandbox environments for development.