mini-api-gateway

An API gateway sits in front of your services doing the unglamorous work: checking who is calling, deciding whether they are allowed through, then passing the request along. I kept seeing the term without really knowing what was inside one, so I built a small one.

A request to /proxy hits a filter that reads the x-api-key header and asks a rate limiter whether this caller has any budget left. The limiter keeps a counter in Redis against that key, set to expire after 60 seconds, so five requests a minute get through and the sixth gets a 429. Anything that survives the filter is forwarded upstream.

Letting Redis do the remembering was the part that clicked. A counter that expires on its own is a far simpler thing to reason about than one you have to remember to clean up, and the sliding window falls out of the expiry for free.

Still small. One route, one upstream. Next up is validating the key properly rather than only rate limiting on it, plus an atomic counter so concurrent requests cannot slip past the window.

Built with: Java 21, Spring Boot, Redis, Maven