An API gateway is software that sits in front of a company's APIs, so that every request to them passes through it first. It sends each request to the right service, checks that the caller is allowed in, limits how often each caller may call, and counts every call. An API is a fixed set of requests that one program accepts from other programs.
Why is it needed? A modern app is split into many small programs called services: one for orders, one for payments, one for user accounts, and so on. Each service has its own API. Without a gateway, each service must check every caller, apply its own limits and keep its own records. With a gateway, these jobs are done once, in one place, and each service does only its own work.
Consider a food-delivery company in Gurugram with 40 services. At dinner time on a Saturday, its app sends about 8,000 requests a second. One request arrives from a customer's phone: GET /orders/88213. The gateway does four things with it, in a few milliseconds.
First, it checks the caller. The request carries a token, a signed piece of text that the login system gave the customer when she signed in. The gateway checks the signature, and so knows who she is. For employees and partners, the token often comes from the company's single sign-on (SSO) system.
Second, it applies a limit. Restaurant partners can also call the company's API, to update their menus. Each partner may send 100 requests a minute. Say one partner's faulty program sends a 101st request within the same minute. The gateway answers "429 Too Many Requests" and does not pass the request on. So one faulty caller cannot slow the system down for everyone else. This is called rate limiting.
Third, it routes the request. Requests starting with /orders go to the order service; requests starting with /payments go to the payment service. If six copies of the order service are running, the gateway picks one that is not busy, as a load balancer does.
Fourth, it records the call: who called, what was asked, when, and how long the answer took. These records go to an observability platform, where engineers can see when a service slows down. They are also used to bill partners who pay for each call.
The gateway checks who is allowed in. It does not look deeply for attacks hidden inside allowed requests. That is the job of API security tools, which study the traffic that the gateway passes through.
Many gateways are free open-source software. The company that leads the project sells a version with support, a management screen and extra features. The newest use is in front of AI models. Set up as an AI gateway, the same software routes and counts the requests that apps and AI agents send to language models. The APIs themselves are designed and tried out in an API development platform.