Why should I use an API gateway instead of custom auth and routing in every service?

An API gateway is useful when you want to centralize cross-cutting concerns that otherwise get duplicated across services.

Why use a gateway?

Instead of implementing the same logic in every service, a gateway can handle:

• Authentication / authorization
  Validate tokens, API keys, OAuth, etc. once at the edge.
• Routing
  Send requests to the right backend service based on path, host, version, or headers.
• Rate limiting / throttling
  Protect services from abuse or accidental overload.
• Request/response transformation
  Rewrite headers, paths, or payloads for compatibility.
• Logging / metrics / tracing
  Centralize observability and auditing.
• TLS termination / WAF / security policies
  Keep security controls in one place.

Benefits over custom logic in each service

• Less duplication: avoids copy-pasting auth/routing code everywhere.
• Consistency: one policy for the whole system.
• Faster changes: update auth rules or routing once, not in every service.
• Simpler services: business services focus on business logic.
• Better edge security: services can stay private/internal, exposed only through the gateway.

When custom auth/routing in each service may be better

A gateway isn’t always the right answer. Sometimes per-service handling is preferable when:

• Each service has very different auth rules
• You need service-level autonomy and want fewer central dependencies
• Traffic is mostly internal service-to-service, where a gateway adds unnecessary hops
• You already have service mesh / sidecar infrastructure handling similar concerns

Tradeoffs of a gateway

• Extra hop / latency
• Potential bottleneck or single point of failure
• More operational complexity
• Risk of overloading it with too many responsibilities

Practical rule of thumb

Use an API gateway when you have:

• multiple services,
• shared edge concerns,
• external clients,
• and a need for consistent governance.

Skip it or keep it thin when:

• the system is small,
• services are independent and simple,
• or the overhead outweighs the benefits.

If you want, I can also give you a decision matrix for “API gateway vs custom auth vs service mesh.”