API Gateway Setup for Mobile Applications
Mobile client shouldn't know five different services, three teams and two databases are behind it. API Gateway is the entry point that handles authentication, routing, rate limiting and response transformation, offloading infrastructure code from services themselves.
What Gateway Solves and What It Doesn't
Gateway is good for: single TLS termination, JWT validation without duplication in each service, rate limiting by IP and token, API versioning (/v1, /v2), logging all incoming requests.
Gateway isn't a replacement for business logic. Aggregating multiple services into one response is better done in BFF (Backend for Frontend) — separate service for specific client. Gateway isn't for if (user.isPremium) { ... }.
Options and Choice
| Solution | When Suitable | Features |
|---|---|---|
| Kong | Kubernetes, many plugins, self-hosted | Declarative config via CRD, out-of-the-box OAuth2/JWT/rate-limit plugins |
| AWS API Gateway | Infrastructure on AWS | Native Lambda, Cognito, WAF integration; pay per request |
| Traefik | Kubernetes-native, GitOps | Automatic service discovery, cert-manager integration |
| Nginx + njs | Simple case, minimal overhead | JavaScript scripting, but harder scaling configuration |
| Custom Go service (BFF) | Data aggregation, non-standard logic | Full control, but needs maintenance |
For most mobile projects on Kubernetes — Kong or Traefik. For AWS environment — AWS API Gateway with Lambda authorizer.
Key Settings for Mobile Client
Rate limiting. Two levels: by IP (DDoS protection) and by token (protection from client bugs, retry storms). Kong rate-limiting plugin: 100 req/min for anonymous IP, 1000 req/min for authenticated user. On exceed — 429 Too Many Requests with Retry-After header.
JWT validation. Gateway checks signature and token expiry, passes X-User-ID and X-User-Role upstream. Services trust these headers without re-verifying signature — removes jsonwebtoken dependency from each service.
Timeouts. Connect timeout 5 seconds, read timeout 30 seconds. If upstream doesn't answer — Gateway returns 504 Gateway Timeout, not hangs. Mobile client gets explicit error and can show user meaningful message.
Circuit breaker at Gateway level. Kong proxy-cache + health-check plugins: on 50% errors in 10 seconds, Gateway stops sending requests to unhealthy upstream and returns cache or 503.
Case: e-commerce app, 5 backend services. Before Gateway each service validated JWT independently: 5 code copies, secret update required deploying all five. After Kong: JWT plugin in one place, X-User-ID passed as header, token validation time drops to 2 ms at Gateway vs 15–20 ms in each service.
Setup timeline: basic Gateway config with routing, JWT, rate limiting — 3–5 days. Full setup with monitoring, WAF, CI/CD for config — 2–3 weeks.