Improve API Performance: Gateway Caching with Kong, Nginx, AWS

Imagine: your API handles 10,000 requests per second, the backend barely copes, and half the responses return the same data. Caching at the gateway level solves this in a couple of hours without changing service code. Recently, on a project with 50 microservices, we implemented caching on Kong, and the database load dropped by 80%, while the average response time decreased from 500 ms to 50 ms. We integrate caching on the gateway (Kong, Nginx, AWS) and reduce backend load by 30–70%. After configuration, hit rate reaches 95%. This article is based on practice backed by 10+ years of experience on 40+ projects.

Why caching on gateway is better than on the backend?

Cache at the gateway level intercepts the request before it reaches the service. The backend receives no load for cached requests. On the backend, caching often complicates logic and requires modifications to each service. The gateway, on the other hand, is a single configuration point: add a plugin or nginx directive, and it's done. In Kong, the proxy-cache plugin is enabled globally or for specific routes with a single line of configuration. Infrastructure savings can reach 40% — clients typically save $5,000–$15,000 per month on infrastructure costs.

Which endpoints to cache and which not?

Safe to cache:

• GET requests with public data (catalog, directories, articles)
• Responses with Cache-Control: public, max-age=N headers from upstream
• Endpoints that do not depend on session or authorization

Do not cache:

• Any POST, PUT, PATCH, DELETE
• Requests with Authorization: Bearer ... (except user-based isolation)
• Responses with status 4xx/5xx (except deliberate 404 caching)
• Personal data

Setting up caching in Kong, Nginx, and AWS

Below are working configs for three popular gateways. All are battle-tested.

Kong Gateway: proxy-cache plugin

plugins: - name: proxy-cache config: response_code: [200, 301, 404] request_method: [GET, HEAD] content_type: - application/json - application/json; charset=utf-8 cache_ttl: 300 strategy: memory memory: dictionary_name: kong_db_cache # For production replace strategy with redis: # strategy: redis # redis: # host: redis.internal # port: 6379 # timeout: 2000 # database: 0 # password: ${REDIS_PASSWORD} 

Kong adds the X-Cache-Status header with values Hit, Miss, Bypass, Refresh. This helps with debugging.

Cache invalidation via Admin API:

# Remove a specific key curl -X DELETE http://kong-admin:8001/proxy-cache/caches/{cache_key} # Clear entire cache curl -X DELETE http://kong-admin:8001/proxy-cache/ 

AWS API Gateway + ElastiCache

For REST API, native caching is enabled like this:

{ "cacheClusterEnabled": true, "cacheClusterSize": "0.5", "methodSettings": { "GET /products": { "cachingEnabled": true, "cacheTtlInSeconds": 300, "cacheDataEncrypted": false, "requireAuthorizationForCacheControl": false } } } 

Terraform code:

resource "aws_api_gateway_stage" "main" { deployment_id = aws_api_gateway_deployment.main.id rest_api_id = aws_api_gateway_rest_api.main.id stage_name = "v1" cache_cluster_enabled = true cache_cluster_size = "0.5" method_settings { resource_path = "/products" http_method = "GET" settings { caching_enabled = true cache_ttl_in_seconds = 300 } } } 

Invalidation via request with Cache-Control: max-age=0 header (requires execute-api:InvalidateCache permission).

Nginx: proxy_cache

proxy_cache_path /var/cache/nginx/api levels=1:2 keys_zone=api_cache:10m max_size=1g inactive=10m use_temp_path=off; server { location /api/v1/catalog/ { proxy_cache api_cache; proxy_cache_valid 200 5m; proxy_cache_valid 404 1m; proxy_cache_use_stale error timeout updating http_500 http_502 http_503; proxy_cache_background_update on; proxy_cache_lock on; # Cache key — without authorization parameters proxy_cache_key "$scheme$request_method$host$uri$is_args$args"; # Do not cache if client sends session cookie proxy_cache_bypass $cookie_session_id; proxy_no_cache $cookie_session_id; add_header X-Cache-Status $upstream_cache_status; proxy_pass http://backend; } } 

proxy_cache_use_stale updating + proxy_cache_background_update on implements the stale-while-revalidate pattern: the user instantly receives the old response while the update happens in the background. Critical for high-load endpoints.

Performance comparison: Nginx on a gateway handles up to 100,000 RPS, which is 2x more than Kong in memory mode (50,000 RPS). AWS REST API handles up to 10,000 RPS depending on cluster size.

Avoiding cache stampede

When a popular key's TTL expires, dozens of workers simultaneously hit the upstream — this is a cache stampede. Three mitigation approaches:

• Mutex/lock: only one request updates the cache, others wait (e.g., proxy_cache_lock on in Nginx).
• Probabilistic early expiration: update the cache slightly before TTL with probability increasing toward expiration time.
• Stale-while-revalidate: serve the old response while the update proceeds (implemented above).

Invalidation is the headache of caching. The most reliable way is to use resource versioning (e.g., /api/v2/products instead of ?version=2). If versioning is not possible, use:

• Purge requests (Nginx purge, Kong Admin API).
• Short TTL with parallel updates (stale-while-revalidate).
• Tag-based invalidation (e.g., via Surrogate-Key in Kong).

Never clear the entire cache unless absolutely necessary — it will cause a cache stampede.

Process of work

1. Analysis: audit endpoints, identify candidates for caching.
2. Design: choose strategy, cache key, TTL, invalidation method.
3. Implementation: configure gateway, write Terraform/Ansible if needed.
4. Testing: measure hit ratio, verify correctness for authorized requests.
5. Monitoring: dashboards with hit rate, cache size, miss count.

What's included in the work

• Caching configuration for selected routes.
• Documentation on invalidation and monitoring.
• Team training (1–2 hours).
• Guarantee of correct operation for one month.

Contact us for a consultation — we'll assess your project within one day. Experience of over 10 years and 40+ successful implementations guarantee results. Order caching configuration and get results in 1–5 days.