Design an API Gateway

Requirements

• •Route incoming requests to backend services based on URL path and HTTP method
• •Validate authentication tokens (JWT or API key) before proxying requests
• •Apply per-consumer rate limiting with configurable quotas (req/sec and req/day)
• •Implement circuit breaking: stop routing to unhealthy upstream services
• •Log all requests with latency, status codes, and consumer identity for observability

Non-Functional Requirements

• •Gateway latency overhead < 5ms (p99)
• •Support 100,000 requests/second across all routes
• •Rate limit decisions must be consistent across all gateway instances
• •Gateway remains operational if 50% of downstream services are down

Constraints

• •Downstream services communicate over HTTP/gRPC
• •API keys and JWTs are the only supported auth mechanisms in v1
• •The gateway must add less than 5ms of latency overhead

Evaluation Criteria