Do I need an API gateway to enforce quotas per customer?

Not necessarily.

You need some mechanism to enforce quotas per customer, but that does not have to be an API gateway. An API gateway is one common place to do it, especially if you already have one in front of your APIs, but other options are often better depending on your architecture.

When an API gateway makes sense

Use a gateway if you want:

• Centralized enforcement for many APIs/services
• Simple rate limiting / quota rules at the edge
• Consistent authentication + metering
• To block requests before they hit backend services

This is a good fit for:

• Per-customer request limits
• Per-plan limits
• Basic burst control / throttling

When you may not need a gateway

You can enforce quotas in:

• Your application/backend
• A shared middleware/service
• A dedicated quota service
• The load balancer / ingress
• An API management platform that isn’t strictly a gateway

This can be better if:

• Quotas depend on business logic or complex usage rules
• You need distributed counters or multi-region consistency
• Different products/services have different quota models
• You don’t want to couple quota policy to edge routing

Important distinction: rate limits vs quotas

• Rate limit = “no more than X requests per minute”
• Quota = “up to Y requests/units per billing period”

A gateway is usually good at the first, and sometimes the second.
For real customer billing quotas, you often also need:

• Usage tracking
• Billing-period resets
• Deduplication/idempotency
• Overages / soft limits / hard limits

Practical recommendation

• If your need is just basic per-customer request throttling, an API gateway is a good option.
• If you need accurate billing-grade quotas, use a central quota/usage system, possibly with the gateway enforcing the decision at the edge.
• In many systems, the best design is:
  1. Gateway checks the request
  2. Quota service tracks usage
  3. Backend remains unaware or only validates again for safety

Rule of thumb

• Small/simple system: app-level or gateway-level quota enforcement
• Large/multi-service system: gateway + centralized quota service
• Billing-critical: don’t rely on gateway alone

If you want, I can help you choose an approach based on your stack (e.g. Kubernetes, AWS, Kong, NGINX, Apigee, microservices, etc.).