API Gateway

1. The Incident

The store's backend has grown into eleven services: catalog, search, checkout, orders, accounts, reviews, and more. The web, iOS, and Android clients call them all directly. Each service is its own small entrance. That worked at three services. At eleven, the costs all arrive at once.

Authentication exists eleven times. Each service validates tokens with whatever library version it deployed last. An audit finds three different implementations across two languages. One of them, in the reviews service, is fourteen months old