API Gateway Interview Questions and Answers (With Trade-offs)

The API gateway is the most asked single component in system design interviews, because it is where routing, authentication, rate limiting, and observability all meet. Interviewers use it to find out whether you know what belongs at the edge and what does not.

Twenty questions below, with the answer an interviewer is listening for. The first four cover almost every loop.

The four comparisons you must get right

The one line version. A load balancer spreads traffic across identical things. A gateway routes between different things and enforces policy. A mesh handles traffic that never leaves the cluster.

Basics

1. What is an API gateway?

A single entry point that sits in front of many backend services. A client makes one call to the gateway, and the gateway decides which service should answer it. It also handles the concerns you do not want repeated in every service: authentication, rate limiting, and request logging.

2. What does an API gateway actually do?

• Routing. Maps a path, host, or header to a backend service.
• Authentication. Verifies the caller once, at the edge.
• Rate limiting. Caps how often a client can call and returns 429 when they exceed it.
• Aggregation. Calls several services and merges the results into one response.
• Protocol translation. Accepts REST from a browser and speaks gRPC to the backend.
• Observability. Attaches a request id and records every call in one place.
• Load shedding. Drops low priority traffic when the system is under pressure.

3. What is the difference between an API gateway and a load balancer?

A load balancer distributes traffic across identical instances of one service. It does not care what the request means. A gateway reads the request, understands it, and routes to different services based on the path or headers. It also enforces auth and rate limits, which a load balancer never does.

Most systems run both. The load balancer sits in front of the gateway instances, because the gateway itself needs to be replicated.

4. What is the difference between an API gateway and a reverse proxy?

A reverse proxy forwards requests to backends and can cache, terminate TLS, and compress. A gateway is a reverse proxy plus API aware features: per route authentication, per client rate limits, request and response transformation, and aggregation across services. Every gateway is a reverse proxy. Not every reverse proxy is a gateway.

5. What are the benefits of an API gateway?

Clients get one address instead of many. Cross cutting concerns live in one place instead of being reimplemented per service. Backend services can be split, merged, or moved without clients noticing. And you get one place to see all traffic, which makes debugging and rate limiting possible at all.

6. What are the disadvantages of an API gateway?

It is a single point of failure, so it must be replicated across zones. It adds a network hop and therefore latency. It becomes a deployment bottleneck when every team needs a config change shipped through it. And it can turn into a dumping ground for business logic, which is the failure interviewers have actually seen.

Naming that last one is what separates a memorised answer from experience.

Routing and composition

7. How does a gateway decide where to send a request?

By matching rules in order: usually host, then path prefix, then method, then headers. /v1/payments/* goes to the payments service. A Version header can pick between two revisions of the same service. Rules are evaluated most specific first, which is why an unordered rule set produces confusing bugs.

8. What is request aggregation, and when is it a bad idea?

Aggregation means the gateway calls several services and combines the results so the client makes one request. It helps mobile clients on slow networks.

It is a bad idea when the composition encodes business rules. Once the gateway knows that an order needs a customer and a shipment and a discount, that knowledge lives outside every service that owns it. Prefer a dedicated composition service, or the backend for frontend pattern below.

9. What is the backend for frontend pattern?

One gateway per client type instead of one shared gateway. The mobile gateway returns compact payloads shaped for small screens. The web gateway returns richer ones. Each is owned by the team that owns that client.

The benefit is that nobody negotiates a shared response shape across teams. The cost is more gateways to run.

10. How does a gateway handle protocol translation?

It accepts one protocol from the client and speaks another to the backend. The common case is REST and JSON at the edge, gRPC and Protocol Buffers internally. Browsers cannot speak gRPC directly, so the gateway bridges the gap. It can also translate between HTTP and a message queue for asynchronous work.

Security

11. Should authentication happen at the gateway or in the service?

Authentication at the gateway, authorisation in the service. The gateway verifies the token and establishes who the caller is, so every service does not repeat that work. The service decides whether that caller may perform this specific action, because only the service knows its own rules.

12. How does a gateway pass identity to the backend?

It validates the incoming token, then forwards a trusted internal representation, often a signed header or a short lived internal token. Services must not accept that header from anywhere except the gateway, which means the network has to prevent direct access to services.

13. Can a gateway replace a firewall or a WAF?

No. A gateway enforces API level policy. A web application firewall inspects payloads for attack patterns, and a network firewall controls which hosts can talk at all. They sit in front of or alongside a gateway rather than being replaced by it.

14. Where does TLS terminate?

Usually at the load balancer or the gateway. Traffic behind it may run in plaintext inside a trusted network, or continue as mutual TLS if the environment requires it. Say which model you are assuming, because the answer changes what the gateway can inspect.

Rate limiting and resilience

15. How does rate limiting work at a gateway?

The gateway counts requests per client per window and rejects the ones over the limit with 429 Too Many Requests. It should return the limit, the remaining count, and the reset time in headers. Add Retry-After on the rejection, so a well behaved client slows down instead of retrying immediately.

16. Where does the rate limit counter live?

In a shared store such as Redis. Gateway instances are replicated, and a per instance counter would let a client multiply its allowance by the instance count. The trade off is that the store now sits on the request path. It has to be fast and replicated. Decide whether it fails open or closed, based on what the limit protects.

17. What happens when a backend service is down?

The gateway should fail fast rather than hold connections. A circuit breaker tracks failures and stops calling a sick service for a while, which prevents one failure from consuming every thread in the system. Where possible it returns a fallback response so the client still renders something.

18. Should the gateway retry failed requests?

Only for idempotent operations. Retrying a GET is safe. Retrying a POST that creates a payment can charge someone twice unless the request carries an idempotency key. Retries also need backoff and a cap, or a struggling service gets a retry storm on top of its original problem.

Scale and operations

19. How do you scale an API gateway?

Run many stateless instances behind a load balancer, in more than one availability zone. Keep per request state out of the gateway so any instance can serve any request. Watch for the two real bottlenecks: the shared rate limit store, and any per request work such as token verification that can be cached.

20. When should you not use an API gateway?

For a single service with one client, it is a hop and a config file for no gain. For internal service to service traffic, a service mesh is usually the better fit, because that traffic does not pass through the edge. And if teams keep pushing business logic into it, the gateway becomes a shared monolith with a different name. That is worse than not having one.

How to answer gateway questions well

Three habits raise the score.

Say where the concern belongs. Most gateway questions are really about placement. Auth at the edge, authorisation in the service. Rate limits at the edge, business rules in the service.

Name the failure mode. Every gateway feature has one: a single point of failure, a shared bottleneck, a config deployment queue. Naming it unprompted reads as experience.

Say both, then choose. Gateway or mesh, aggregate or not, retry or not. Give the condition that decides it, then pick one.

Frequently asked questions

What are the most common API gateway interview questions?

What a gateway does, and how it differs from a load balancer and a reverse proxy. Then where authentication belongs, how rate limiting works across replicated instances, and what the downsides are. The gateway versus load balancer comparison is the single most frequent.

Is an API gateway the same as a load balancer?

No. A load balancer spreads traffic across identical copies of one service and does not inspect meaning. A gateway routes between different services and enforces policy such as authentication and rate limits. Real systems use both.

Do microservices need an API gateway?

Not always, but usually. Without one, every client has to know every service address and each service reimplements authentication and rate limiting. With very few services and one client, the gateway is overhead.

What is the difference between an API gateway and a service mesh?

A gateway handles traffic entering the system from outside, often called north to south. A mesh handles traffic between internal services, called east to west. Many systems run both, and they solve different problems.

Which API gateway should I name in an interview?

Naming one is optional and rarely scores. If asked, Kong, NGINX, Envoy, AWS API Gateway, and Netflix Zuul are the common examples. The reasoning about placement matters far more than the product name.

Does an API gateway slow things down?

It adds one network hop, usually a few milliseconds. What it saves normally outweighs that. Fewer client round trips through aggregation, cached auth checks, and early rejection of traffic that would otherwise reach your services.

Where to go next

Gateway questions are usually one part of a broader round. For the concept in depth, read the advantages and disadvantages of an API gateway and load balancer vs API gateway, both free.

Is the round about the contract rather than the infrastructure? Grokking Modern API Design Interview covers what the gateway sits in front of, including rate limiting in the contract.

For the wider system design round, Grokking the System Design Interview covers the framework and the building blocks.

Related Reading

• Load balancer vs reverse proxy vs API gateway
• API interview questions
• API design interview questions
• What is an API gateway and what role does it play in microservices?