API Gateway Configurator

Enterprise skill for configuring and managing API gateways for microservices architectures.

When to Use

This skill should be used when:

• Setting up API gateway for microservices
• Configuring rate limiting and throttling
• Implementing API authentication and authorization
• Setting up request/response transformation
• Configuring API routing and load balancing
• Implementing API versioning strategies
• Setting up API monitoring and analytics
• Managing API documentation and developer portals

Instructions

Step 1: Choose API Gateway Platform

Select the appropriate API gateway based on requirements:

Kong Gateway (Open Source/Enterprise):

• Best for: Kubernetes-native, plugin ecosystem
• Strengths: Performance, extensibility, cloud-native
• Use cases: Microservices, multi-cloud, hybrid cloud

AWS API Gateway:

• Best for: AWS-native applications, serverless
• Strengths: AWS integration, managed service, scalability
• Use cases: Lambda functions, AWS services, serverless APIs

Tyk:

• Best for: GraphQL, multi-cloud, analytics
• Strengths: Developer portal, analytics, open source
• Use cases: GraphQL federation, API analytics

Apigee (Google Cloud):

• Best for: Enterprise API management, monetization
• Strengths: Analytics, developer portal, API products
• Use cases: External APIs, partner APIs, API monetization

Step 2: Configure Core Features

Kong Configuration Example:

# kong.yml - Declarative configuration
_format_version: "3.0"

services:
  - name: user-service
    url: http://user-service:8080
    routes:
      - name: user-routes
        paths:
          - /api/v1/users
        methods:
          - GET
          - POST
        strip_path: false
    plugins:
      - name: rate-limiting
        config:
          minute: 100
          policy: local
      - name: jwt
        config:
          claims_to_verify:
            - exp
      - name: cors
        config:
          origins:
            - "*"
          methods:
            - GET
            - POST
          headers:
            - Accept
            - Authorization
          max_age: 3600

  - name: order-service
    url: http://order-service:8080
    routes:
      - name: order-routes
        paths:
          - /api/v1/orders
    plugins:
      - name: rate-limiting
        config:
          minute: 50
      - name: request-transformer
        config:
          add:
            headers:
              - "X-Gateway:Kong"

# Global plugins
plugins:
  - name: prometheus
    config:
      per_consumer: true
  - name: correlation-id
    config:
      header_name: X-Correlation-ID
      generator: uuid

AWS API Gateway Configuration:

# serverless.yml for AWS API Gateway
provider:
  name: aws
  runtime: nodejs18.x
  apiGateway:
    apiKeys:
      - name: premium-api-key
        value: ${env:API_KEY}
    usagePlan:
      - premium:
          quota:
            limit: 5000
            period: MONTH
          throttle:
            burstLimit: 200
            rateLimit: 100
    resourcePolicy:
      - Effect: Allow
        Principal: "*"
        Action: execute-api:Invoke
        Resource:
          - execute-api:/*/*/*

functions:
  getUsers:
    handler: users.getUsers
    events:
      - http:
          path: users
          method: get
          cors: true
          authorizer:
            name: jwtAuthorizer
            type: request
          request:
            parameters:
              querystrings:
                page: false
                limit: false
          throttling:
            maxRequestsPerSecond: 100
            maxConcurrentRequests: 50

  createUser:
    handler: users.createUser
    events:
      - http:
          path: users
          method: post
          cors: true
          authorizer: jwtAuthorizer

Step 3: Implement Authentication & Authorization

JWT Authentication (Kong):

# Create JWT consumer
consumers:
  - username: mobile-app
    jwt_credentials:
      - key: mobile-app-key
        algorithm: HS256
        secret: ${JWT_SECRET}

# Apply JWT plugin to service
services:
  - name: protected-service
    plugins:
      - name: jwt
        config:
          header_names:
            - Authorization
          claims_to_verify:
            - exp
            - nbf

OAuth2 (Kong):

plugins:
  - name: oauth2
    config:
      scopes:
        - read
        - write
        - admin
      mandatory_scope: true
      enable_authorization_code: true
      enable_client_credentials: true
      enable_implicit_grant: false
      token_expiration: 3600
      refresh_token_ttl: 2592000

Step 4: Configure Rate Limiting & Throttling

# Kong - Multiple rate limiting strategies
plugins:
  # Per-consumer rate limiting
  - name: rate-limiting
    consumer: mobile-app
    config:
      second: 10
      minute: 100
      hour: 1000
      policy: redis
      redis:
        host: redis-cluster
        port: 6379
        database: 0

  # Advanced rate limiting
  - name: rate-limiting-advanced
    config:
      limit:
        - minute: 100
        - hour: 1000
      window_size:
        - 60
        - 3600
      sync_rate: 10
      strategy: cluster
      dictionary_name: kong_rate_limiting_counters

Step 5: Set Up Request/Response Transformation

# Request transformation
plugins:
  - name: request-transformer
    config:
      add:
        headers:
          - "X-Request-ID:$(uuid)"
          - "X-Forwarded-For:$(client_ip)"
        querystring:
          - "version:v1"
      remove:
        headers:
          - "Authorization"  # Don't pass to backend
      replace:
        headers:
          - "Host:backend-service"

# Response transformation
plugins:
  - name: response-transformer
    config:
      add:
        headers:
          - "X-Response-Time:$(latency)"
          - "X-Gateway:Kong"
      remove:
        headers:
          - "X-Internal-Secret"
      replace:
        json:
          - "$.metadata.source:api-gateway"

Step 6: Implement API Versioning

# URL path versioning
services:
  - name: user-service-v1
    url: http://user-service-v1:8080
    routes:
      - paths:
          - /api/v1/users

  - name: user-service-v2
    url: http://user-service-v2:8080
    routes:
      - paths:
          - /api/v2/users

# Header-based versioning
routes:
  - name: versioned-route
    paths:
      - /api/users
    plugins:
      - name: request-transformer
        config:
          add:
            headers:
              - "X-API-Version:$(header.Accept-Version)"

Step 7: Configure Monitoring & Analytics

# Prometheus metrics
plugins:
  - name: prometheus
    config:
      per_consumer: true
      status_code_metrics: true
      latency_metrics: true
      bandwidth_metrics: true
      upstream_health_metrics: true

# Logging
plugins:
  - name: file-log
    config:
      path: /var/log/kong/access.log
      reopen: true

  - name: http-log
    config:
      http_endpoint: http://log-aggregator:8080/logs
      method: POST
      content_type: application/json
      timeout: 10000
      keepalive: 60000

# Datadog integration
plugins:
  - name: datadog
    config:
      host: datadog-agent
      port: 8125
      metrics:
        - name: request_count
          stat_type: counter
        - name: latency
          stat_type: timer

Best Practices

Security:

• ✅ Always use HTTPS/TLS for API gateway
• ✅ Implement JWT or OAuth2 for authentication
• ✅ Use API keys for external partners
• ✅ Enable CORS with specific origins
• ✅ Implement request size limits
• ✅ Add security headers (HSTS, CSP, etc.)

Performance:

• ✅ Enable caching for GET requests
• ✅ Use Redis for distributed rate limiting
• ✅ Configure connection pooling to backends
• ✅ Set appropriate timeouts
• ✅ Enable gzip compression
• ✅ Use CDN for static content

Reliability:

• ✅ Configure health checks for backends
• ✅ Implement circuit breakers
• ✅ Set up retry policies
• ✅ Configure fallback responses
• ✅ Use multiple gateway instances
• ✅ Monitor gateway metrics

Operations:

• ✅ Use declarative configuration (GitOps)
• ✅ Version control gateway configs
• ✅ Implement blue-green deployments
• ✅ Set up comprehensive logging
• ✅ Configure alerts for anomalies
• ✅ Regular security audits

Examples

Example 1: Microservices E-Commerce Gateway

# Kong configuration for e-commerce platform
services:
  - name: product-catalog
    url: http://catalog-service:8080
    routes:
      - paths: ["/api/v1/products"]
    plugins:
      - name: rate-limiting
        config:
          minute: 1000
      - name: cors
      - name: jwt
      - name: response-cache
        config:
          strategy: memory
          memory:
            dictionary_name: kong_cache

  - name: shopping-cart
    url: http://cart-service:8080
    routes:
      - paths: ["/api/v1/cart"]
    plugins:
      - name: rate-limiting
        config:
          minute: 100
      - name: jwt
      - name: request-size-limiting
        config:
          allowed_payload_size: 10

  - name: checkout
    url: http://checkout-service:8080
    routes:
      - paths: ["/api/v1/checkout"]
    plugins:
      - name: rate-limiting
        config:
          minute: 50
      - name: jwt
      - name: bot-detection
      - name: ip-restriction
        config:
          allow:
            - 10.0.0.0/8

Example 2: AWS API Gateway with Lambda

# API Gateway with Lambda integration
functions:
  getUserProfile:
    handler: handlers/users.getProfile
    events:
      - http:
          path: users/{userId}/profile
          method: get
          cors:
            origin: 'https://app.example.com'
            headers:
              - Content-Type
              - Authorization
          authorizer:
            arn: arn:aws:lambda:us-east-1:123456789:function:authorizer
            resultTtlInSeconds: 300
            identitySource: method.request.header.Authorization
          request:
            parameters:
              paths:
                userId: true
          caching:
            enabled: true
            ttlInSeconds: 300
            dataEncrypted: true

Common Mistakes to Avoid

• ❌ Not implementing rate limiting
• ❌ Exposing internal service URLs
• ❌ No authentication on public APIs
• ❌ Missing CORS configuration
• ❌ No monitoring or logging
• ❌ Hardcoding credentials in config
• ❌ Not versioning APIs
• ❌ Single gateway instance (no HA)
• ❌ No request/response validation
• ❌ Missing error handling

✅ Correct approach:

• Implement multi-layer rate limiting
• Use service discovery internally
• JWT/OAuth2 authentication
• Proper CORS with allowed origins
• Comprehensive monitoring
• Use environment variables/secrets
• Version APIs from day one
• Deploy in HA configuration
• Validate all inputs/outputs
• Implement circuit breakers

Tips

• 💡 Start with managed API gateway for faster setup
• 💡 Use declarative configuration for repeatability
• 💡 Implement caching to reduce backend load
• 💡 Monitor gateway metrics continuously
• 💡 Use API gateway for security boundary
• 💡 Implement request tracing for debugging
• 💡 Version APIs early, migrate gradually
• 💡 Test rate limiting before production

Related Skills/Commands

Skills:

• microservices-orchestrator

  - Microservices architecture

• service-mesh-integrator

  - Service mesh integration

• distributed-tracing-setup

  - Request tracing

Commands:

• /dependency-graph

  - Visualize API dependencies

• /load-test-suite

  - Test API gateway performance

• /security-posture

  - Security assessment

Agents:

• enterprise-architect

  - Architecture design

• security-architect

  - Security configuration

• sre-consultant

  - SLO/SLI setup

Notes

API Gateway Selection Criteria:

• ✅ Kong: Best for Kubernetes, open source, plugin ecosystem
• ✅ AWS API Gateway: Best for AWS Lambda, managed service
• ✅ Tyk: Best for GraphQL, analytics, multi-cloud
• ✅ Apigee: Best for enterprise API management

Common Patterns:

• Backend for Frontend (BFF) pattern
• API composition
• API aggregation
• Protocol translation (REST to gRPC)
• Request/response transformation

Production Checklist:

• TLS/HTTPS enabled
• Authentication configured
• Rate limiting implemented
• CORS configured
• Monitoring enabled
• Logging configured
• Health checks set up
• High availability (3+ instances)
• Backup and disaster recovery
• Documentation updated