Table of contents
What's an API Gateway
An API gateway is like a manager for different services in an app. It handles requests from users, decides which service should handle each request, and then sends back the response. This way, it simplifies how users interact with multiple services and keeps things organized
Function of API Gateway
1)Routing: Directs requests to the appropriate backend service based on the request's details
2)Aggregation: Combines reponses from multiple services into a single response to simplify client interactions
3)Authentications & Authorization: Manages security by verifying the identity of users and ensuring they have permission to access resources
4)Rate Limiting & Throttling: Controls the number of requests a user or application can make in a given time frame to prevent abuse and ensure fair usage
5)Load Balancing: Distributes incoming requests acrros multiple servers to ensure no single server becomes overloaded
6)Caching: Stores frequently requested data temporarily to reduce load times and imprve performance
7)Logging & Monitoring:Tracks request data and service performance to help wiht debugging and maintaining the health of the system
8) Request & Response Transformation: Modifies requests and resposnes as needed, such as changing data formats or adding headers
9)Error Handling: Manages and formats error messages to provide clear feedback to users and systems
Authentications
1) Basic Authentication:
Involves sending a username and password with each request, but can be less secure wihthout encryption
When to use: Suitable for simple applications where security and encryptions aren't the prime concern when used over secured connections
2) Token Authentication:
Uses generated tokens, like JSON Web Tokens(JWT), exchnaged between client and server, offering enhanced security without sending login crendentials with each requests
When to use: Ideal for more secure and scalable systems, especially when avoiding sending login credentials with each request is a priority
3) OAuth Authentication:
Enables third-party limited access to user resources wihtout revealing credentials by issuing access tokens after use authentications
When to use: Ideal for scenarios requiring controlled access to user resources by third-party applications or services
4) API Key Authentication:
Assigns unique keys to users or applications, sent in headers or parameters: while simple, it might lack the security features of token based or OAuth methods.
When to use:Convenient for straightforward access control in less sensitive environments or for granting access to certian functionalities without the need for user-specific permissions
Add-ons
In REST APIs, different HTTP methods are used to perform various operatinos on resources. Here are the most commonly used methods:
1) GET
Purpose: Retrieve data from the server
Idempotent:Yes (repeated requests should produce the same result)
2) POST
Purpose: Create a new resource on the server
Idempotent: No (multiple requests may result in multilpe resources being created)
3) PUT
Purpose: Update an existing resource or create a new resource if it doesn't exist
Idempotent: Yes(repeated requests with same data should have the same effect).
4) PATCH:
Purpose: Partially update an existing resource
Idempotent: No (the effect depends on the nature of the patch)
5) DELETE:
Purpose: Remove a resource from the server
Idempotent: Yes (repeated requests should produce the same result)
6) OPTIONS:
Purpose: Describe the communications options for the target resource
Idempotent: Yes (the request does not alter the state of the resource)
7) HEAD:
Purpose: Retrieves the headers of a resource without the body
Idempotent: Yes (Like GET but wihtout the response body)