API Gateway Security

Centralize auth, TLS, routing, and policy at the edge

15 min+56 XP1 quiz

Module progress1 of 4

Opening

One door, many services

An API gateway (Kong, NGINX, AWS API Gateway, Cloudflare, Envoy) sits in front of microservices. Done well, it enforces TLS, auth, quotas, and WAF rules once—so every backend inherits a baseline.

1. What the gateway should own

TLS termination & mTLS
Encrypt client traffic; optionally authenticate service-to-service.
Authn at the edge
Validate JWT/OAuth, API keys, or mutual TLS before proxying.
Routing & versioning
/v1 vs /v2, canary, and shadow traffic without exposing internals.
Threat filters
Body size limits, geo blocks, bot scores, schema validation.

2. Do not forget

Gateways do not replace object-level authorization inside each service. Pass a verified identity (sub, scopes) downstream and still check BOLA on every object. Lock down admin gateway UIs and rotate secrets.

Knowledge Check

API gateways are best used to:

Multiple choice

← Previous

Answer all 1 knowledge check to continue. (0/1 answered)

Guest mode — log in to track XP