Glossary
API Gateway
An API gateway is a server that acts as the single entry point for client requests, handling cross-cutting concerns such as authentication, rate limiting, routing and request transformation before forwarding traffic to backend services.
General definition
An API gateway decouples clients from the internal topology of backend services. Instead of a mobile app knowing the addresses of a message service, a user service, a media service and a presence service, it talks to one gateway URL. The gateway holds routing rules that map incoming requests to the correct upstream service based on the path, method or other headers.
- Authentication and authorisation: validates tokens (JWT, API keys) before the request reaches any backend service
- Rate limiting and throttling: enforces per-client or per-plan quotas at the edge
- Request transformation: translates between client-facing and internal API contracts
- Load balancing: distributes traffic across backend instances
- Observability: centralised logging, tracing and metrics for all inbound traffic
- TLS termination: handles HTTPS at the edge, passing plain HTTP internally
Popular open-source gateways include Kong, Envoy, Traefik and NGINX in proxy mode. Cloud-managed options include AWS API Gateway, Google Cloud Apigee and Azure API Management. In microservice architectures the gateway is often the component that implements the Backend For Frontend (BFF) pattern, tailoring responses to the needs of web, mobile or third-party consumers.
For real-time systems, the gateway must also handle WebSocket upgrades and long-lived connections, not just short HTTP requests. Not all gateway products support this equally well, so protocol support is a key selection criterion for chat and messaging platforms.
In the Ethora ecosystem
Ethora’s cloud and dedicated deployments place an API gateway in front of the platform services, handling token validation, rate limiting and WebSocket connection management before traffic reaches the messaging core. This ensures that every request is authenticated and metered consistently regardless of which backend service ultimately handles it.
On self-hosted installations, operators can integrate their own gateway (such as AWS API Gateway, Kong or Nginx) in front of the Ethora stack. This is common in regulated industries where traffic inspection, WAF rules and centralised audit logging at the network edge are required by compliance frameworks.
