API Gateways and Backends for Frontends — API Architecture and Integration Design

An API gateway is the single entry point that handles TLS, authentication, rate limiting, routing, request size limits and observability for many services. A Backend for Frontend (BFF) is a client-specific layer (web, mobile) that aggregates and shapes data, reducing chatty calls and keeping tokens server-side for browser apps. Keep business logic in services, not in gateways.

Client (web) ──► API Gateway ──► Web BFF ──► orders-service
                  │ TLS, authN,              ├─► users-service
                  │ rate limits, WAF         └─► recommendations-service
Client (mobile) ─► API Gateway ──► Mobile BFF (smaller payloads, offline-friendly)

Common pitfalls

A gateway full of business logic (a new monolith).
One BFF shared by all clients (back to generic APIs).
Gateway as a single point of failure without redundancy.

Key points

Gateway: cross-cutting concerns
BFF: per-client aggregation
Keep business logic in services

Further reading: Sam Newman: Backends for Frontends

Practice questions

What problems does a BFF solve?

Answer

It aggregates multiple service calls into client-shaped responses, reduces round trips (especially for mobile), and can hold tokens server-side for browser security.

What should NOT live in an API gateway?

Answer

Domain/business logic and data transformations specific to one feature; those belong in services or BFFs.