Doesn't an API gateway become a single point of failure?

It becomes a single logical chokepoint, which is why it never runs as a single instance. Production gateways run as multiple stateless replicas behind a load balancer, often per region, and hold no request state, so any replica can serve any request. The remaining risk is a bad config push taking out all replicas at once, which teams manage with canary rollouts of gateway configuration.

Should authorization live in the gateway too, or just authentication?

Authentication (verifying who the caller is) belongs in the gateway because it is identical for every route. Authorization (whether this user may act on this resource) usually needs domain data, like who owns order 89, which lives in the service. Coarse checks such as requiring an admin scope on /admin/* routes are fine at the gateway; fine-grained checks belong next to the data.

Do I need an API gateway if I only have one backend service?

Mostly no. A load balancer plus middleware inside the service covers auth and logging fine at that size. The gateway earns its hop when multiple services need shared edge behavior, or when you want to reorganize backends without touching clients. Adding one early is not catastrophic, but it is one more thing to operate before it pays rent.

Architecturechapter 2 of 5 · 3 lessons

API Gateway

Single entry point for all client traffic. Auth, routing, rate limiting, and aggregation in one layer.

← All chapters View in cheatsheet

Once you have more than one backend service, somebody has to answer the question every client asks: where do I send this? An API gateway is that answer, one entry point that authenticates, routes, throttles and shapes traffic before any backend sees it.

Done well, it stops twenty services each reimplementing the same auth middleware. Done badly, it becomes a slow political bottleneck every team is afraid to touch. Which one you get is decided early, by what you allow into it.

Lessons

3 in this chapter

The Front DoorOne address for clients, one routing table for the platform team.2 min
Cross-Cutting Concerns, Done OnceAuth, rate limits, and logging written one time instead of once per service.2 min
Gateway vs Load Balancer vs BFFThree boxes that all sit in front of servers and do three different jobs.3 min