api-gateway-patterns
API Gateway patterns for routing, authentication, rate limiting, and service composition in microservices architectures. Use when implementing API gateways, building BFF layers, or managing service-to-service communication at scale.
- Installs
- 101
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/nickcrew/claude-cortex --skill api-gateway-patterns- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads api-gateway-patterns automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
API Gateway Patterns
Expert guidance for implementing API gateways with routing, authentication, traffic management, and service composition patterns for microservices architectures at scale.
When to Use This Skill
- Implementing API gateway infrastructure for microservices
- Designing Backend for Frontend (BFF) layers
- Adding authentication and authorization at the gateway level
- Implementing rate limiting, circuit breakers, and retry logic
- Setting up service discovery and dynamic routing
- Building API composition and aggregation layers
- Managing cross-cutting concerns (logging, monitoring, CORS)
- Evaluating gateway solutions (Kong, Nginx, Envoy, AWS API Gateway)
Core Concepts
Gateway Responsibilities
Routing: Direct requests to appropriate backend services based on path, headers, or host Security: Centralized authentication, authorization, and API key validation Traffic Management: Rate limiting, circuit breakers, retry logic Composition: Aggregate multiple service calls into unified responses Transformation: Modify requests/responses for client optimization or legacy adaptation
Architecture Patterns
Single Gateway: One gateway for all clients (simple, potential bottleneck) BFF Pattern: Separate gateway per client type (mobile, web, admin) - optimized for each GraphQL Gateway: Schema stitching across services, client-driven data fetching Service Mesh: Distributed gateway pattern with sidecar proxies (Istio, Linkerd)
Quick Reference
| Task | Load reference |
|---|---|
| Routing strategies (path, header, host-based) | skills/api-gateway-patterns/references/routing-patterns.md |
| Request/response transformation | skills/api-gateway-patterns/references/transformation.md |
| API composition and aggregation | skills/api-gateway-patterns/references/composition.md |
| Authentication & authorization (JWT, OAuth, RBAC) | skills/api-gateway-patterns/references/authentication.md |
| Traffic management (rate limiting, circuit breakers) | skills/api-gateway-patterns/references/traffic-management.md |
| Backend for Frontend (BFF) pattern | skills/api-gateway-patterns/references/bff-pattern.md |
| Service discovery integration | skills/api-gateway-patterns/references/service-discovery.md |
| Gateway implementations (Kong, Nginx, Envoy, AWS) | skills/api-gateway-patterns/references/implementations.md |
Implementation Workflow
Phase 1: Requirements Analysis
- Identify client types: Mobile, web, admin, partners
- Map service landscape: Catalog backend services and endpoints
- Define cross-cutting concerns: Auth, logging, monitoring, CORS
- Determine composition needs: Which endpoints require aggregation?
- Establish SLAs: Latency, throughput, availability targets
Phase 2: Gateway Design
- Choose architecture: Single gateway vs BFF vs GraphQL
- Select implementation: Kong, Nginx, Envoy, AWS API Gateway
- Design routing rules: Path-based, header-based, host-based
- Plan authentication: JWT, OAuth 2.0, API keys, or hybrid
- Define traffic policies: Rate limits, circuit breakers, timeouts
Phase 3: Implementation
- Set up infrastructure: Deploy gateway instances, configure load balancer
- Implement routing: Configure service discovery and route definitions
- Add authentication: JWT validation, OAuth integration, API key management
- Apply traffic management: Rate limiting, circuit breakers, retry logic
- Enable observability: Distributed tracing, metrics, structured logging
Phase 4: Testing & Optimization
- Load testing: Verify performance under expected and peak load
- Failure injection: Test circuit breakers and retry logic
- Security testing: Verify auth flows, token validation, RBAC policies
- Latency optimization: Cache strategies, connection pooling
- Monitor and tune: Adjust timeouts, limits based on real traffic
Best Practices
- Centralize Cross-Cutting Concerns: Authentication, logging, monitoring at gateway
- Keep Gateway Lightweight: Avoid complex business logic, delegate to services
- Implement Health Checks: Monitor upstream service health, remove unhealthy instances
- Use Circuit Breakers: Prevent cascading failures, fail fast
- Apply Rate Limiting: Protect services from overload, implement tiered limits
- Enable Observability: Distributed tracing, metrics, structured logging
- Version APIs: Support multiple API versions, plan deprecation
- Secure Communication: TLS everywhere, mutual TLS for service-to-service
- Cache Strategically: Response caching, but invalidate properly
- Test Resilience: Chaos engineering, failure injection, load testing
Common Mistakes
- Business Logic in Gateway: Keep gateway focused on routing/security, not business rules
- Chatty Composition: Too many upstream calls (use BFF, GraphQL, or caching)
- Single Point of Failure: Deploy redundantly, use load balancers
- No Timeout Configuration: Always set connection/read timeouts to prevent hanging requests
- Ignoring Backpressure: Implement queue limits, graceful degradation
- Over-Aggregation: Don't make gateway do too much work (compute-heavy transformations)
- Inadequate Monitoring: Must track latency, errors, throughput at gateway level
- No Rate Limiting: Services will be overwhelmed eventually without protection
- Synchronous Everything: Use async patterns for non-critical operations
- No Version Strategy: Breaking changes break all clients simultaneously
Resources
- Kong: https://docs.konghq.com/gateway/latest/
- Nginx: https://nginx.org/en/docs/
- Envoy: https://www.envoyproxy.io/docs/envoy/latest/
- AWS API Gateway: https://docs.aws.amazon.com/apigateway/
- Patterns: "Microservices Patterns" by Chris Richardson
- Service Mesh: https://istio.io/latest/docs/
- Circuit Breakers: Martin Fowler's CircuitBreaker pattern
- BFF Pattern: Sam Newman's "Building Microservices"
FAQ
What does the api-gateway-patterns skill do?
API Gateway patterns for routing, authentication, rate limiting, and service composition in microservices architectures. Use when implementing API gateways, building BFF layers, or managing service-to-service communication at scale.
How do I install api-gateway-patterns?
Run npx skills add https://github.com/nickcrew/claude-cortex --skill api-gateway-patterns in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/api-gateway-patterns/ (personal) or .claude/skills/api-gateway-patterns/ (project).
Which AI agents can use api-gateway-patterns?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is api-gateway-patterns safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains api-gateway-patterns?
It is published by nickcrew in nickcrew/claude-cortex. It has 101 recorded installs.
More from nickcrew/claude-cortex
react-performance-optimization
nickcrew/claude-cortex
React performance optimization patterns using memoization, code splitting, and efficient rendering strategies. Use when optimizing slow React applications, reducing bundle size, or improving user experience with large datasets.
owasp-top-10
nickcrew/claude-cortex
OWASP Top 10 security vulnerabilities with detection and remediation patterns. Use when conducting security audits, implementing secure coding practices, or reviewing code for common security vulnerabilities.
ui-design-aesthetics
nickcrew/claude-cortex
Open the skill to read its SKILL.md instructions.
threat-modeling-techniques
nickcrew/claude-cortex
Open the skill to read its SKILL.md instructions.
token-efficiency
nickcrew/claude-cortex
Compressed communication using symbols and abbreviations. Use when context is limited or brevity is needed.
helm-chart-patterns
nickcrew/claude-cortex
Open the skill to read its SKILL.md instructions.
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.