How API Gateways Centralize Auth, Routing, and Cross-Cutting Concerns

When a monolithic application is split into microservices, clients must manage multiple endpoints, each with its own authentication and rate-limiting logic. An API gateway solves this by acting as a single entry point that handles shared concerns — such as TLS termination, authentication, CORS, and logging — in one place before routing requests to the appropriate backend service. Requests pass through an ordered filter chain, ensuring authentication runs before rate limiting and both run before any backend resources are consumed. Gateways typically validate JWTs locally for speed or use opaque tokens for instant revocation, then forward a trusted identity header to backend services for finer-grained authorization. Because every request flows through the gateway, it must be stateless and horizontally scalable, with shared state like rate-limit counters offloaded to an external store such as Redis.