Glossary
API Gateway
An API gateway sits at the edge of a system as a single chokepoint that all external API traffic passes through before reaching any backend service, giving a natural place to enforce authentication and coarse-grained access policy once, consistently, rather than reimplementing the same checks separately inside every individual backend service. This centralizes exactly the kind of check that's easy to implement slightly differently, and therefore inconsistently, if left to each service on its own.
A gateway's centralization is also its risk concentration: because every request passes through it, a gateway misconfiguration or vulnerability potentially affects every route and every backend service behind it at once, rather than being contained to one isolated service — which makes the gateway's own configuration deserve outsized scrutiny relative to its apparent simplicity as 'just a router in front of everything.'