Short definition: Gateways that enforce authentication, rate limiting, and security controls for API traffic.
1 min read
What it is
API gateways sit between clients and backend services. They enforce authentication, schema validation, throttling, IP filtering, and logging.
Why it matters
APIs are a major attack vector. Gateways standardize protection and reduce direct exposure of backend systems.
How to reduce risk
- Require API keys or OAuth
- Implement rate limiting
- Validate schemas
- Block direct backend access
- Monitor for anomalies
- Enforce TLS everywhere
Related Terms
External Resources
- OWASP API Security Top 10: https://owasp.org/www-project-api-security/
- NIST API Security: https://csrc.nist.gov/publications/detail/sp/800-204c/final