An application programming interface (API) is the intermediary that facilitates communication between applications. The need for faster innovation and reliance on data sharing between applications has made APIs indispensable to modern ecosystems. Since APIs carry sensitive data between applications, they’ve quickly become an attractive target for malicious attackers. 

The challenge posed by attackers has led to the introduction of API gateways, which are API management tools that sit between backend services and client applications. They provide a single entry for all API calls and introduce security features that protect the backend services. 

This article discusses API gateways and their operations, architecture, deployment options, features, and integration capabilities. Then, it highlights some best practices for working with API gateways.

Gateways give APIs value

An API allows organizations to share their data or functions with client applications. API gateways serve as intermediaries between API providers and API consumers and offer the below benefits.

1. They allow organizations to securely share the data in the database by providing proxying capabilities for the backend services and applying additional functionalities in the form of policies on these proxies. They provide security measures such as identity and access management, anti-virus filters, and blocking malicious access. 
2. They allow organizations to easily monetize their APIs by supporting usage metering and user management features. 
3. They provide analytics and dashboard capabilities to support measuring the success of API programs through KPIs and other metrics. 
4. They reduce organizations’ APIs request latency by providing caching capabilities.  
5. They protect backend systems through rate limiting and enforcing quotas. 
6. They provide request and response transformation capabilities to ensure that the user and backend applications speak the same language. 

How API gateways operate

The API gateway is a tool that sits between the client application and the backend application. The request from the client goes through the gateway first, which ensures that it is a legitimate and secure request, it is not going to harm the backend system, and it is in a language that the backend application understands. Once the backend application processes the request, its response hits the gateway first, which makes sure that the client will not see data that it is not authorized to see, handles errors that may have occurred in the backend processes, and makes sure that the response is in a form that the client application is coded to receive. 

Here’s how API gateways operate:

1. Decoupling client apps from backend services: An API gateway provides a client app with a URL connecting to it, not the backend services, called proxying. Therefore, the client doesn’t need to include backend application details in its code logic. 
2. Securing backend applications: The client making the request is unaware of how backend services interacted with its request. This obscurity protects the backend services’ endpoints from being exposed to malicious attackers. 
3. Apply policies on requests and responses: API gateways offer many policies, including security, identity and access management, error handling, data masking, routing, and load balancing, so the backend application engineers don’t worry about these concerns. 
4. Monitoring and analytics: Because all the requests and responses pass through the API gateway, it collects rich analytics on these. It allows for analyzing trends, measuring KPIs, identifying malicious attacks, and looking at the business value of APIs. This helps organizations measure and optimize their API strategy.

Deployment options

When deciding where to deploy an API gateway, you have three options to choose from:

1. On-premises
2. Cloud
3. Hybrid

The on-premises option means you deploy all the necessary components in your data center. This option gives you complete control of your deployment and all its aspects. Additionally, you get complete control of the deployment’s architecture and security. 
 
The cloud option means all the gateway’s components are deployed in a cloud environment. It allows your API gateway to be deployed and set up by the service provider in just a few minutes. Additionally, you only incur the cost of the resources it consumes. 
 
In a hybrid deployment, you deploy some components in your data centers and others in the cloud. This option gives you both on-premises and cloud benefits. It allows you to deploy and shift your API gateway to where it makes the most economic sense.

API gateway features

API gateways have several features that enable them to handle API management responsibilities. These features include: 

1. Load balancers to reduce latency by distributing requests evenly between servers. They can also route the request to servers geographically close to the client to reduce response times. 
2. Rate limits to prevent the misuse of backend services. This involves allowing a specified maximum number of requests within a set period. They also use this feature to control consumption when exposing an API to third-party users. 
3. A monitoring mechanism that tracks response times, number of requests, and compliance with service level agreements (SLAs). 
4. Multi-protocol support that allows clients to use protocols different from the database servers when making requests. 
5. Simple management of APIs. Gateways allow you to add, publish, or remove APIs that clients can access. 
6. Multi-cloud deployment can be close to where your customers are. They may be in different geographies, clouds, or data centers. With the ability to deploy a hybrid or multi-cloud gateway, you can decrease the latency and distribute the load.

API gateway security and best practices

One of the most significant benefits of using an API gateway is decoupling client apps from backend services. Some of the approaches API gateways employ include:

1. Requiring authentication and authorization details for users sending requests by integrating with authentication providers, such as OpenID Connect (OIDC), JSON web tokens (JWT), OAuth, and API keys. They also provide authorization solutions that control the specific assets authenticated accounts can access. They integrate with role-based access control (RBAC) technologies for this task.
2. Employing rate limits to prevent attacks such as denial of service (DoS) that flood target endpoints with traffic. These attacks can stop the APIs from processing legitimate requests.
3. Validating input to stop processing bad requests, reducing unnecessary backend calls. They implement this by validating the parameters and headers of incoming requests, significantly reducing the chances of SQL injection attacks.
4. Protecting data in transit by employing encryption protocols, such as TLS. This prevents malicious attackers from carrying out man-in-the-middle attacks.

API gateways are critical if you want to protect your organization’s backend services from malicious attacks. They’re indispensable when sharing data with third parties through APIs. 
 
Some of the best practices for implementing security at the API gateway level include:

1. Implementing a least privileges policy of access for reading, writing, deleting, or altering data with an API.
2. Implementing logging to understand requests and simplify investigation in the event of an attack.
3. Trusting no one. Ensuring the gateway authenticates all requests before processing them.
4. Ensuring your backend services are capable of processing requests fast. These allow your customers to get their responses quickly and also allow the gateway to enforce the specified policies on all requests coming in quickly.
5. Ensuring that communication between clients and the API gateways uses HTTPS.
6. Keeping track of all active APIs and removing those not in use anymore.

API gateway integration

API gateways’ ability to integrate with other security solutions makes securing and monitoring them easier. This means you can deploy them to maximize business value.

Some existing integrations include NoName, Cequence, and Salt. NoName secures an API gateway by proactively detecting vulnerabilities, design flaws, and misconfigurations. Cequence has rich API discovery and attach detection capabilities. Salt focuses on providing full lifecycle protection to APIs and API gateways.

Kiabi: A success story

Kiabi is a retailing powerhouse based in France that boasts a revenue of up to 1.8 billion euros. It’s one of many of Software AG’s API management solution success stories. After implementing an API gateway, Kiabi reduced its application development time by 50 percent, improved its website’s response time from 3.6 to 1.2 seconds, and expanded its online presence to 32 countries.

Kiabi created visual workflows first, enabling it to set up a powerful interconnected system. Thanks to webMethods, it could access integration and API management within the same tool. An important lesson that Kiabi learned while transforming its APIs was that having the right tool and partner makes a big difference.

Conclusion

An API gateway sits between client apps and the backend applications, allowing organizations to better protect and manage their endpoints. You can deploy in the cloud, on premises, or in a hybrid environment. 

API gateways work by decoupling client apps from backend services, aggregating requests, cross-cutting concerns, and securing backend services.

Because APIs can increase the rate of innovation and provide an efficient and secure means of sharing data between applications, they’re indispensable to modern organizations. However, they transmit sensitive data between applications, making them targets for malicious attackers. So, when implementing an API gateway, ensure you follow security best practices such as always authenticating requests, encrypting in-transit data, implementing logging, and keeping track of APIs.