building-api-gateway_skill

Overview

This skill automates creation of API gateways with routing, load balancing, rate limiting, and authentication. It guides you from API design and schema definition through scaffolding, middleware integration, and OpenAPI documentation. Use it to produce production-ready gateway components and deployment-ready configuration.

How this skill works

The skill inspects API design requirements, existing specifications, and target backends to generate routing, middleware, and configuration artifacts. It scaffolds routes, controllers, models, and middleware, and integrates authentication, rate limiting, and load-balancing hooks. It also emits OpenAPI 3.0 documentation and test scaffolds so you can validate behavior and integrate CI/CD pipelines.

When to use it

• You need a single entry point for multiple backend services and consistent routing.
• You want centralized authentication, authorization, or token validation across services.
• You must enforce rate limits, quotas, or global throttling policies.
• You want automatic OpenAPI documentation and contract-driven development.
• You are preparing API routing for blue/green or canary deployments.

Best practices

• Start with a clear API design and OpenAPI schemas before generating code.
• Define authentication and authorization strategy (JWT, OAuth2, mTLS) up front.
• Use environment-specific configuration for load balancing and upstream service discovery.
• Include integration and contract tests for all gateway-managed endpoints.
• Apply observability: logging, tracing, and metrics for gateway traffic and errors.

Example use cases

• Create a gateway that routes public API requests to several microservices with JWT authentication.
• Add rate limiting and IP-based throttling in front of a set of internal APIs.
• Scaffold an API gateway with load balancing and retries for a legacy service migration.
• Generate OpenAPI docs and test suites for a new product API aggregated from multiple teams.
• Implement a central authentication middleware that validates tokens and enforces roles before forwarding requests.