API Gateway Configurator

Enterprise skill for configuring and managing API gateways for microservices architectures.

When to Use

This skill should be used when:

• Setting up API gateway for microservices

• Configuring rate limiting and throttling

• Implementing API authentication and authorization

• Setting up request/response transformation

• Configuring API routing and load balancing

• Implementing API versioning strategies

• Setting up API monitoring and analytics

• Managing API documentation and developer portals

Instructions

Step 1: Choose API Gateway Platform

Select the appropriate API gateway based on requirements:

Kong Gateway (Open Source/Enterprise):

• Best for: Kubernetes-native, plugin ecosystem

• Strengths: Performance, extensibility, cloud-native

• Use cases: Microservices, multi-cloud, hybrid cloud

AWS API Gateway:

• Best for: AWS-native applications, serverless

• Strengths: AWS integration, managed service, scalability

• Use cases: Lambda functions, AWS services, serverless APIs

Tyk:

• Best for: GraphQL, multi-cloud, analytics

• Strengths: Developer portal, analytics, open source

• Use cases: GraphQL federation, API analytics

Apigee (Google Cloud):

• Best for: Enterprise API management, monetization

• Strengths: Analytics, developer portal, API products

• Use cases: External APIs, partner APIs, API monetization

Step 2: Configure Core Features

Kong Configuration Example:

kong.yml - Declarative configuration

_format_version: "3.0"

services:

• name: user-service url: http://user-service:8080 routes:

  • name: user-routes paths:
    • /api/v1/users methods:
    • GET
    • POST strip_path: false plugins:
  • name: rate-limiting config: minute: 100 policy: local
  • name: jwt config: claims_to_verify: - exp
  • name: cors config: origins: - "*" methods: - GET - POST headers: - Accept - Authorization max_age: 3600

• name: order-service url: http://order-service:8080 routes:

  • name: order-routes paths:
    • /api/v1/orders plugins:
  • name: rate-limiting config: minute: 50
  • name: request-transformer config: add: headers: - "X-Gateway:Kong"

Global plugins

plugins:

• name: prometheus config: per_consumer: true
• name: correlation-id config: header_name: X-Correlation-ID generator: uuid

AWS API Gateway Configuration:

serverless.yml for AWS API Gateway

provider: name: aws runtime: nodejs18.x apiGateway: apiKeys: - name: premium-api-key value: ${env:API_KEY} usagePlan: - premium: quota: limit: 5000 period: MONTH throttle: burstLimit: 200 rateLimit: 100 resourcePolicy: - Effect: Allow Principal: "" Action: execute-api:Invoke Resource: - execute-api:///

functions: getUsers: handler: users.getUsers events: - http: path: users method: get cors: true authorizer: name: jwtAuthorizer type: request request: parameters: querystrings: page: false limit: false throttling: maxRequestsPerSecond: 100 maxConcurrentRequests: 50

createUser: handler: users.createUser events: - http: path: users method: post cors: true authorizer: jwtAuthorizer

Step 3: Implement Authentication & Authorization

JWT Authentication (Kong):

Create JWT consumer

consumers:

• username: mobile-app jwt_credentials:
  • key: mobile-app-key algorithm: HS256 secret: ${JWT_SECRET}

Apply JWT plugin to service

services:

• name: protected-service plugins:
  • name: jwt config: header_names: - Authorization claims_to_verify: - exp - nbf

OAuth2 (Kong):

plugins:

• name: oauth2 config: scopes: - read - write - admin mandatory_scope: true enable_authorization_code: true enable_client_credentials: true enable_implicit_grant: false token_expiration: 3600 refresh_token_ttl: 2592000

Step 4: Configure Rate Limiting & Throttling

Kong - Multiple rate limiting strategies

plugins:

Per-consumer rate limiting

• name: rate-limiting consumer: mobile-app config: second: 10 minute: 100 hour: 1000 policy: redis redis: host: redis-cluster port: 6379 database: 0

Advanced rate limiting

• name: rate-limiting-advanced config: limit: - minute: 100 - hour: 1000 window_size: - 60 - 3600 sync_rate: 10 strategy: cluster dictionary_name: kong_rate_limiting_counters

Step 5: Set Up Request/Response Transformation

Request transformation

plugins:

• name: request-transformer config: add: headers: - "X-Request-ID:$(uuid)" - "X-Forwarded-For:$(client_ip)" querystring: - "version:v1" remove: headers: - "Authorization" # Don't pass to backend replace: headers: - "Host:backend-service"

Response transformation

plugins:

• name: response-transformer config: add: headers: - "X-Response-Time:$(latency)" - "X-Gateway:Kong" remove: headers: - "X-Internal-Secret" replace: json: - "$.metadata.source:api-gateway"

Step 6: Implement API Versioning

URL path versioning

services:

• name: user-service-v1 url: http://user-service-v1:8080 routes:

  • paths:
    • /api/v1/users

• name: user-service-v2 url: http://user-service-v2:8080 routes:

  • paths:
    • /api/v2/users

Header-based versioning

routes:

• name: versioned-route paths:
  • /api/users plugins:
  • name: request-transformer config: add: headers: - "X-API-Version:$(header.Accept-Version)"

Step 7: Configure Monitoring & Analytics

Prometheus metrics

plugins:

• name: prometheus config: per_consumer: true status_code_metrics: true latency_metrics: true bandwidth_metrics: true upstream_health_metrics: true

Logging

plugins:

• name: file-log config: path: /var/log/kong/access.log reopen: true

• name: http-log config: http_endpoint: http://log-aggregator:8080/logs method: POST content_type: application/json timeout: 10000 keepalive: 60000

Datadog integration

plugins:

• name: datadog config: host: datadog-agent port: 8125 metrics: - name: request_count stat_type: counter - name: latency stat_type: timer

Best Practices

Security:

• ✅ Always use HTTPS/TLS for API gateway

• ✅ Implement JWT or OAuth2 for authentication

• ✅ Use API keys for external partners

• ✅ Enable CORS with specific origins

• ✅ Implement request size limits

• ✅ Add security headers (HSTS, CSP, etc.)

Performance:

• ✅ Enable caching for GET requests

• ✅ Use Redis for distributed rate limiting

• ✅ Configure connection pooling to backends

• ✅ Set appropriate timeouts

• ✅ Enable gzip compression

• ✅ Use CDN for static content

Reliability:

• ✅ Configure health checks for backends

• ✅ Implement circuit breakers

• ✅ Set up retry policies

• ✅ Configure fallback responses

• ✅ Use multiple gateway instances

• ✅ Monitor gateway metrics

Operations:

• ✅ Use declarative configuration (GitOps)

• ✅ Version control gateway configs

• ✅ Implement blue-green deployments

• ✅ Set up comprehensive logging

• ✅ Configure alerts for anomalies

• ✅ Regular security audits

Examples

Example 1: Microservices E-Commerce Gateway

Kong configuration for e-commerce platform

services:

• name: product-catalog url: http://catalog-service:8080 routes:

  • paths: ["/api/v1/products"] plugins:
  • name: rate-limiting config: minute: 1000
  • name: cors
  • name: jwt
  • name: response-cache config: strategy: memory memory: dictionary_name: kong_cache

• name: shopping-cart url: http://cart-service:8080 routes:

  • paths: ["/api/v1/cart"] plugins:
  • name: rate-limiting config: minute: 100
  • name: jwt
  • name: request-size-limiting config: allowed_payload_size: 10

• name: checkout url: http://checkout-service:8080 routes:

  • paths: ["/api/v1/checkout"] plugins:
  • name: rate-limiting config: minute: 50
  • name: jwt
  • name: bot-detection
  • name: ip-restriction config: allow: - 10.0.0.0/8

Example 2: AWS API Gateway with Lambda

API Gateway with Lambda integration

functions: getUserProfile: handler: handlers/users.getProfile events: - http: path: users/{userId}/profile method: get cors: origin: 'https://app.example.com' headers: - Content-Type - Authorization authorizer: arn: arn:aws:lambda:us-east-1:123456789:function:authorizer resultTtlInSeconds: 300 identitySource: method.request.header.Authorization request: parameters: paths: userId: true caching: enabled: true ttlInSeconds: 300 dataEncrypted: true

Common Mistakes to Avoid

• ❌ Not implementing rate limiting

• ❌ Exposing internal service URLs

• ❌ No authentication on public APIs

• ❌ Missing CORS configuration

• ❌ No monitoring or logging

• ❌ Hardcoding credentials in config

• ❌ Not versioning APIs

• ❌ Single gateway instance (no HA)

• ❌ No request/response validation

• ❌ Missing error handling

✅ Correct approach:

• Implement multi-layer rate limiting

• Use service discovery internally

• JWT/OAuth2 authentication

• Proper CORS with allowed origins

• Comprehensive monitoring

• Use environment variables/secrets

• Version APIs from day one

• Deploy in HA configuration

• Validate all inputs/outputs

• Implement circuit breakers

Tips

• 💡 Start with managed API gateway for faster setup

• 💡 Use declarative configuration for repeatability

• 💡 Implement caching to reduce backend load

• 💡 Monitor gateway metrics continuously

• 💡 Use API gateway for security boundary

• 💡 Implement request tracing for debugging

• 💡 Version APIs early, migrate gradually

• 💡 Test rate limiting before production

Related Skills/Commands

Skills:

• microservices-orchestrator

• Microservices architecture

• service-mesh-integrator

• Service mesh integration

• distributed-tracing-setup

• Request tracing

Commands:

• /dependency-graph

• Visualize API dependencies

• /load-test-suite

• Test API gateway performance

• /security-posture

• Security assessment

Agents:

• enterprise-architect

• Architecture design

• security-architect

• Security configuration

• sre-consultant

• SLO/SLI setup

Notes

API Gateway Selection Criteria:

• ✅ Kong: Best for Kubernetes, open source, plugin ecosystem

• ✅ AWS API Gateway: Best for AWS Lambda, managed service

• ✅ Tyk: Best for GraphQL, analytics, multi-cloud

• ✅ Apigee: Best for enterprise API management

Common Patterns:

• Backend for Frontend (BFF) pattern

• API composition

• API aggregation

• Protocol translation (REST to gRPC)

• Request/response transformation

Production Checklist:

• TLS/HTTPS enabled

• Authentication configured

• Rate limiting implemented

• CORS configured

• Monitoring enabled

• Logging configured

• Health checks set up

• High availability (3+ instances)

• Backup and disaster recovery

• Documentation updated