API Gateway — Animate | AI Wisdom

← Back to topic
🎞 ANIMATE · Mode 3 of 5 · +100 XP— API Gateway
📋Auth
⚙️Routing
🔄Aggregation
✅Resilience
🎯 Next: Test →
Step 1 / 4
Speed
Auth
Gateway validates JWT — services trust gateway-forwarded identity💡 Analogy
Like a concert security gate — once you pass the entrance check, you can move freely inside.
The gateway validates every request's JWT. If valid, it attaches user info to the request and proxies. Services behind the gateway can trust the user identity from the gateway.
Console Output
> Authorization: Bearer eyJ...
> JWT verified: { id: "u-1", role: "user" }
> X-User-Id: u-1 forwarded to microservice
●api-gateway.ts
AuthL9–15
1// API Gateway — single entry point for microservices
2// Handles: auth, rate limiting, load balancing, routing, transformation
3 
4import express from 'express';
5import { createProxyMiddleware } from 'http-proxy-middleware';
6 
7const gateway = express();
8 
9// 1. Auth middleware — validate JWT before proxying
10gateway.use(async (req, res, next) => {
11  const token = req.headers.authorization?.replace('Bearer ', '');
12  if (!token) return res.status(401).json({ error: 'Unauthorized' });
13  try {
14    req.user = await verifyJWT(token); // attach user to request
15    next();
16  } catch { res.status(401).json({ error: 'Invalid token' }); }
17});
18 
19// 2. Route to microservices
20const services = {
21  users:  'http://user-service:3001',
22  orders: 'http://order-service:3002',
23  catalog: 'http://catalog-service:3003',
24};
25 
26gateway.use('/api/users', createProxyMiddleware({
27  target: services.users,
28  changeOrigin: true,
29  pathRewrite: { '^/api/users': '' }, // /api/users/123 → /123
30}));
31 
32gateway.use('/api/orders', createProxyMiddleware({
33  target: services.orders,
34  changeOrigin: true,
35  pathRewrite: { '^/api/orders': '' },
36  // Circuit breaker in real production
37}));
38 
39// 3. Response transformation — consumer-specific shape
40gateway.get('/api/dashboard', async (req, res) => {
41  const [user, orders, notifications] = await Promise.all([
42    fetch(`${services.users}/${req.user.id}`).then(r => r.json()),
43    fetch(`${services.orders}?userId=${req.user.id}`).then(r => r.json()),
44    fetch(`${services.users}/${req.user.id}/notifications`).then(r => r.json()),
45  ]);
46  res.json({ user, orders, notifications }); // aggregated response
47});
48 
49async function verifyJWT(token: string): Promise<any> { return {}; }
49 lines
Timeline — 4 Steps
Auth
Gateway validates JWT — services trust gateway-forwarded identity💡 Analogy
Like a concert security gate — once you pass the entrance check, you can move freely inside.
The gateway validates every request's JWT. If valid, it attaches user info to the request and proxies. Services behind the gateway can trust the user identity from the gateway.
Console Output
> Authorization: Bearer eyJ...
> JWT verified: { id: "u-1", role: "user" }
> X-User-Id: u-1 forwarded to microservice

Was this page helpful?

Discussion

Gateway validates JWT — services trust gateway-forwarded identity

💡 Analogy

Like a concert security gate — once you pass the entrance check, you can move freely inside.

The gateway validates every request's JWT. If valid, it attaches user info to the request and proxies. Services behind the gateway can trust the user identity from the gateway.

Console Output

> Authorization: Bearer eyJ...
> JWT verified: { id: "u-1", role: "user" }
> X-User-Id: u-1 forwarded to microservice

Gateway validates JWT — services trust gateway-forwarded identity

💡 Analogy

Like a concert security gate — once you pass the entrance check, you can move freely inside.

The gateway validates every request's JWT. If valid, it attaches user info to the request and proxies. Services behind the gateway can trust the user identity from the gateway.

Console Output

> Authorization: Bearer eyJ...
> JWT verified: { id: "u-1", role: "user" }
> X-User-Id: u-1 forwarded to microservice