API Gateway software

DreamFactory generates documented REST APIs from SQL and NoSQL databases and other sources. It adds API keys, role-based access, rate limits, and server-side scripts on those endpoints, so a team can expose data without writing a separate service for each table. It can run on your own network.

https://www.dreamfactory.com/

Read reviews of DreamFactory

Kong is an API gateway that sits in front of services you already run. It routes requests, checks credentials, applies rate limits, and records traffic through a plugin system. The gateway core is open source, and the commercial product adds a control plane and a developer portal.

https://konghq.com/

Read reviews of Kong

Amazon API Gateway publishes HTTP APIs in front of AWS services such as Lambda, or any HTTP backend you choose. It handles API keys, authorizers, throttling, and separate stages for each environment. Clients call one AWS endpoint instead of calling each service directly.

https://aws.amazon.com/api-gateway/

Read reviews of Amazon API Gateway

Apigee, from Google Cloud, manages APIs with a proxy in front of existing backends. Policies cover authentication, quotas, and abuse controls, and a developer portal publishes the documentation and the credentials callers need. It is built for teams that govern many APIs from one place.

https://cloud.google.com/apigee

Read reviews of Apigee

Azure API Management is Microsoft's gateway for APIs running on Azure or elsewhere. It groups operations into products, applies policies for authentication and rate limits, and hosts a developer portal where callers get keys and documentation. It fits teams already building on Azure.

https://azure.microsoft.com/products/api-management

Read reviews of Azure API Management

Hasura generates a GraphQL API from a database, including PostgreSQL and SQL Server. Role-based permissions decide which rows and columns a caller can read or change, and subscriptions can push live updates. It fits when the job is to expose data, rather than to route APIs that already exist.

https://hasura.io/

Read reviews of Hasura

An API gateway is the front door for the services and data behind an application. It is where a request is checked, limited, and sent on, so each client does not have to know how the systems inside are arranged.

What is an API gateway?

An API gateway sits between the people and programs that call your API and the services that answer. A request arrives at one address. The gateway authenticates it, applies limits, and routes it to the right service.

Some products in this category govern APIs you already have. They add keys, tokens, rate limits, and routing in front of services your team wrote. Others generate the API from a database or another source, then put those same controls on the endpoints they created. Both kinds give callers one documented place to connect, instead of a different address and a different rule for every system.

A gateway also hides change. You can move a service, split a database, or add a version without handing every client a new address. Logs show which methods are called, which credentials fail, and where the time goes, which is hard to see when each service keeps its own record.

Teams use these products to publish an internal API to partners, to put a stable address in front of a set of microservices, or to let an application read and write a database without building a custom service for every table.

What do API gateway solutions control?

They control who can call an API, how often, and which operations they can use. Common controls include API keys, OAuth and JWT, role-based access, request limits, and network rules. Many publish live documentation, keep an audit log, and let you validate or reshape a request before it reaches the data.

Why use an API gateway?

The biggest reason is to stop every service from inventing its own security. One place for keys, limits, and logs is easier to review than a rule copied into each application, and one address is easier for clients to keep working when the systems behind it change.

• Give clients one address and one set of credentials
• Limit and record access to services and data
• Change what is behind the API without breaking callers

How to choose

Start with where the API comes from. If the services already exist, you need a gateway that can route and protect them. If the job is to expose a database or another system that has no API yet, look for a product that can generate the endpoints and then govern them. Check the styles of API you need, such as REST or GraphQL, where the product can run, and whether your data is allowed to leave your own network. A team with both kinds of problem often uses a generated data API behind the same gateway that protects the services it already runs.