Skip to content

API Gateway vs Reverse Proxy

1. Decision

Use a Reverse Proxy (Nginx, HAProxy, Envoy) for high-performance L4/L7 network traffic routing, TLS termination, load balancing, and static file serving; use an API Gateway (Kong, AWS API Gateway, Apigee) for application-level API management, cross-cutting security enforcement (OAuth/JWT, Rate Limiting), API versioning, request transformation, and microservice orchestration.

2. 30-Second Answer

Both components act as reverse proxies positioned between clients and backend microservices, but operate at different architectural layers. A Reverse Proxy (e.g., Nginx) is a lightweight, high-performance infrastructure network appliance operating primarily at L4 (TCP/UDP) and L7 (HTTP). It handles TLS termination, HTTP load balancing, header manipulation, and static asset caching with microsecond latency. An API Gateway is a feature-rich application management layer built on top of or alongside reverse proxies. It provides business-level API cross-cutting concerns: dynamic rate limiting, JWT/OAuth token validation, developer developer portals, API version routing, request/response payload transformation, and billing/analytics metrics.

3. Decision Matrix

Option Best For Avoid When Latency Scalability Consistency Operational Complexity
Reverse Proxy (Nginx / HAProxy / Envoy) Edge ingress load balancing, TLS/SSL offloading, gRPC L7 routing, static media serving, high-throughput network proxying Complex application-level JWT verification, dynamic developer portals, API billing Ultra-Low (Sub-millisecond <1ms C/C++ memory pipeline) Extremely High (Handles 100k+ concurrent connections per core) Stateless network forwarding Low
API Gateway (Kong / AWS API Gateway / Apigee) Microservice ingress management, dynamic rate-limiting, OAuth2/JWT auth validation, API versioning, request payload transformation Simple static file serving, pure high-frequency raw TCP forwarding without API logic Low to Medium (2-10ms plugin execution pipeline overhead) High (Scales horizontally; plugin memory tuning required) Centralized API Policy Enforcement Medium to High

4. Selection Rules

Requirement Best Choice Rationale / Example
High-Throughput Edge Load Balancing & TLS Termination Reverse Proxy (Nginx / Envoy) Offload HTTPS/TLS handshake encryption before reaching internal services
Centralized Authentication & JWT Verification API Gateway (Kong / Apigee) Verify incoming OAuth2/JWT tokens once at gateway, passing validated headers to backends
Dynamic Rate Limiting per API Key / User ID API Gateway Enforce sliding-window rate limits (100 req/min) backed by Redis
gRPC L7 Load Balancing Sidecar Reverse Proxy (Envoy) Parse HTTP/2 gRPC frames to balance RPCs across backend pods
Transform Legacy XML Response to JSON Payload API Gateway Apply request/response transformation plugins at API boundary

5. Tradeoffs

  1. Microsecond Network Speed vs Feature-Rich Application Logic
  2. Gain (Reverse Proxy): Raw performance and low memory footprint; handles millions of requests/sec.
  3. Lose (Reverse Proxy): Limited application-level scripting and API policy enforcement capabilities.
  4. Centralized API Policy Control vs Gateway Bottleneck Risk
  5. Gain (API Gateway): Single pane of glass for security, rate-limiting, and analytics across all microservices.
  6. Lose (API Gateway): Single point of failure; misconfigured gateway plugins can crash all API traffic.
  7. Developer Velocity vs Gateway Plugin Latency Overhead
  8. Gain (API Gateway): Microservice teams avoid writing boilerplate auth and rate-limiting code.
  9. Lose (API Gateway): Each active plugin (Lua/Wasm) adds 1-5ms to end-to-end API response SLAs.
  10. Stateless Forwarding vs Centralized State Dependency
  11. Gain (Reverse Proxy): Pure stateless traffic routing without external DB/Redis dependencies.
  12. Lose (Reverse Proxy): Cannot track rate limit state across clusters without custom Lua scripts.
  13. Infrastructure Costs
  14. Gain (Nginx): Open-source, lightweight, runs on minimal hardware nodes.
  15. Lose (API Gateway): Managed cloud gateways (AWS API Gateway) incur pay-per-million-request billing costs.

6. Interview Counter Questions

  1. What is the difference between Layer 4 (L4) and Layer 7 (L7) load balancing in Nginx / Envoy?
  2. How does an API Gateway handle JWT Authentication and downstream header propagation?
  3. How does Envoy Proxy enable Service Mesh (Istio) sidecar architectures?
  4. What is the impact of placing an API Gateway in front of internal microservice-to-microservice traffic?
  5. How do Lua scripts / WebAssembly (Wasm) plugins extend Nginx and Envoy into full API Gateways?
  6. How do you implement Rate Limiting at the API Gateway layer using Redis?
  7. What is the difference between an Ingress Controller (Kubernetes Nginx Ingress) and an API Gateway (Kong)?
  8. How do you prevent the API Gateway from becoming a single point of failure (SPOF)?
  9. How does AWS API Gateway integrate with AWS Lambda for serverless APIs?
  10. When should you use a Backend-For-Frontend (BFF) instead of a unified global API Gateway?

7. Gold Standard Answers

  1. L4 (Transport): Routes TCP/UDP packets based on IP address and Port without reading HTTP payload (faster, lower CPU). L7 (Application): Inspects HTTP headers, URIs, cookies, and gRPC frames to make intelligent routing decisions.
  2. Gateway verifies incoming JWT signature using public key (JWKS). If valid, it extracts claims (user_id, tenant_id, roles) and passes them to internal microservices via trusted internal HTTP headers (X-User-Id).
  3. Envoy runs as a sidecar container inside the same Kubernetes pod as the app container. It intercepts all incoming/outgoing network traffic, enforcing TLS (mTLS), observability tracing, and circuit breaking transparently.
  4. Anti-pattern! North-South traffic (Client to Data Center) goes through the API Gateway. East-West traffic (Microservice to Microservice) should bypass the API Gateway and use a Service Mesh (Envoy/mTLS) to avoid latency loops.
  5. Nginx (via OpenResty Lua modules) and Envoy (via Wasm / C++ plugins) execute code inline within the network event loop, enabling dynamic auth, rate limiting, and header manipulation without modifying core C binaries.
  6. Gateway uses a Redis sliding window counter or Token Bucket script (INCR + EXPIRE). On request, gateway checks Redis by API Key/IP; if limit exceeded, returns HTTP 429 Too Many Requests.
  7. K8s Ingress Controller routes external HTTP traffic into the cluster to K8s services (routing layer). An API Gateway adds business logic: developer portals, billing, advanced auth, and API lifecycle management.
  8. Deploy multiple stateless gateway instances across Availability Zones behind a Layer 4 Cloud Load Balancer (AWS NLB) with automated DNS health checks and auto-scaling groups.
  9. AWS API Gateway validates incoming requests, handles TLS/CORS/Rate-Limiting, and invokes Lambda functions asynchronously or synchronously via IAM permissions, passing structured event JSONs.
  10. Use a global API Gateway for cross-cutting security, rate limiting, and routing. Use a BFF (Backend-For-Frontend) layer behind the gateway when specific clients (iOS vs Web) require custom tailored aggregations.

8. Common Mistakes

  • Routing internal microservice-to-microservice traffic back out through the external API Gateway (East-West routing loop).
  • Adding complex custom business logic and DB calls inside API Gateway Lua/Wasm plugins, bloating latency.
  • Using AWS API Gateway for high-volume internal microservice RPCs, causing massive AWS billing costs.
  • Failing to strip un-trusted X-User-Id headers at the gateway before forwarding to backend microservices.
  • Using an L4 load balancer for gRPC traffic, pinning all multiplexed HTTP/2 streams to a single backend pod.

9. Keywords

API Gateway, Reverse Proxy, Nginx, HAProxy, Envoy, Kong, AWS API Gateway, L4 vs L7 Load Balancing, TLS Termination, JWT Verification, JWKS, X-User-Id Header, Rate Limiting, North-South Traffic, East-West Traffic, Service Mesh, Wasm Plugins.

10. Cheat Sheet

  • Core Difference: Reverse Proxy = L4/L7 high-performance network routing & TLS offloading; API Gateway = Application-level API policies (Auth, Rate Limiting, Versioning).
  • Traffic Directions: North-South (Client \(\rightarrow\) Backend) uses API Gateway; East-West (Service \(\rightarrow\) Service) uses Service Mesh (Envoy).
  • Authentication Pattern: Validate JWT at Gateway \(\rightarrow\) Strip un-trusted headers \(\rightarrow\) Forward claims to microservices via trusted X-User-Id header.
  • Rate Limiting: Enforce sliding window counters at Gateway using Redis (INCR + EXPIRE), returning 429 Too Many Requests.
  • gRPC Routing: Always use L7 Load Balancing (Envoy) to inspect HTTP/2 frames and balance gRPC RPC streams across pods.
  • High Availability: Deploy stateless gateway instances behind an AWS Network Load Balancer (NLB).

11. Related Decisions