Skip to main content
API Gatewaylesson 3 of 3 · 3 min read

Gateway vs Load Balancer vs BFF

Three things, one spot on the whiteboard

These three get confused because they sit in the same place on a whiteboard, in front of your backends. What separates them is what each one knows.

A load balancer knows about servers. It spreads traffic across identical copies of one thing and checks whether they are alive.

The simple kind sees only addresses and ports, and the smarter kind reads HTTP and routes on paths, which blurs the line. Even then it holds no opinion about your API, your users or your tokens. It is capacity plumbing.

An API gateway knows about your API. It routes between different services, validates identity, limits each consumer, and reshapes requests.

Run both, which is what actually happens. Balancers in front of your redundant gateway instances, and more balancing behind the gateway across each service's copies. Gateway or load balancer is usually the wrong question, because the answer is gateway and load balancers, at different layers.

Backend for frontend

A backend for frontend knows about one specific client. Each client type gets its own thin backend, one for the iOS app and one for the web app, each owned by the team that builds that client.

Watch how differently those two behave. The mobile one merges four service calls into one compact answer, because cell networks punish round trips. The web one returns richer payloads, because a desktop can take them.

Put your aggregation logic here rather than in the gateway, because it changes with a client's screens and not with your platform.

Assemble a workable stack for a mid-size company. A CDN and denial-of-service layer at the edge, one general-purpose gateway doing auth and rate limiting, and a backend per frontend only where client needs genuinely diverge.

Time that last one properly. Adding one per client on day one is ceremony. Adding one when the mobile team's third aggregation request hits your gateway backlog is judgement.

the shape of it
iOS appWeb appMobile BFFmerges 4 callsWeb BFFrich payloadsUser svcOrder svcCatalog svc1 request
step 1 of 2
Each client type gets its own thin backend that aggregates services into the shape that client wants.

Worked example

SoundCloud is the origin story. Around 2013, as they broke apart their monolith, every client (web, iOS, Android, embedded players) hit one shared API, and each feature negotiation dragged in every client team, since a payload change for mobile could break the web player. Phil Calcado's team introduced a backend per client: the iOS BFF could reshape, trim, and merge responses for its app without asking anyone. Ownership followed: the mobile team shipped their BFF on their own schedule. The pattern spread industry-wide because the pain is universal. Netflix landed on a similar shape independently, letting device teams write their own server-side adapters, since a smart TV from 2015 and a modern browser want very different payloads from the same platform.

API Gateway: wrapping up

In the real world

  • 01Netflix built Zuul as the front door for its streaming API, routing device traffic across backend services and using it for auth, load shedding, and canary routing at hundreds of thousands of requests per second.
  • 02SoundCloud coined the backend-for-frontend pattern during its monolith breakup, giving each client platform its own aggregation backend owned by that client's team.
  • 03Kong, built on Nginx and OpenResty, became one of the most deployed open-source gateways by shipping auth, rate limiting, and logging as plugins configured per route.
  • 04Amazon API Gateway sells the whole pattern as a managed service, handling TLS, throttling, and auth integration, priced per million requests, which is often the fastest path for small teams.
  • 05Envoy, created at Lyft, powers both standalone gateways and service meshes; Istio's ingress gateway is Envoy with a control plane, which is why gateway and mesh have converged in many stacks.

Questions people ask

Doesn't an API gateway become a single point of failure?

It becomes a single logical chokepoint, which is why it never runs as a single instance. Production gateways run as multiple stateless replicas behind a load balancer, often per region, and hold no request state, so any replica can serve any request. The remaining risk is a bad config push taking out all replicas at once, which teams manage with canary rollouts of gateway configuration.

Should authorization live in the gateway too, or just authentication?

Authentication (verifying who the caller is) belongs in the gateway because it is identical for every route. Authorization (whether this user may act on this resource) usually needs domain data, like who owns order 89, which lives in the service. Coarse checks such as requiring an admin scope on /admin/* routes are fine at the gateway; fine-grained checks belong next to the data.

Do I need an API gateway if I only have one backend service?

Mostly no. A load balancer plus middleware inside the service covers auth and logging fine at that size. The gateway earns its hop when multiple services need shared edge behavior, or when you want to reorganize backends without touching clients. Adding one early is not catastrophic, but it is one more thing to operate before it pays rent.

Quick review

Cross-cutting concerns:
auth verification, rate limiting, request logging, SSL termination. Done once, not in every service
Routing:
route /api/users/* to user-service, /api/orders/* to order-service based on URL/headers
Aggregation (BFF pattern):
single request to gateway → fan out to 3 services → merge responses. Mobile-friendly
Rate limiting at gateway:
per API key, per IP, per user tier. Before requests hit backend
API Gateway vs Load Balancer:
LB distributes load at L4/L7. API Gateway adds business logic (auth, transformation)
Examples:
Kong (open-source, plugin-based), AWS API Gateway (managed), Nginx + Lua, Envoy proxy
Failure mode:
API Gateway itself is now critical path. Deploy in HA, monitor its latency carefully
the trade-off

Adds network hop and potential bottleneck. Don't put business logic in gateway. Keep it thin.

in the room

Any microservice architecture. Especially when mobile clients need aggregated responses or you need centralized auth.