api-gateway-configuration_skill

Overview

This skill configures API gateways for routing, authentication, rate limiting, and request transformation in microservice architectures. It provides production-ready patterns and example configurations for Kong, Nginx, AWS API Gateway, and Traefik. The focus is on centralized API management to improve security, observability, and operational control.

How this skill works

The skill generates and validates gateway configuration snippets and deployment artifacts for common platforms (Kong, Nginx, AWS SAM, Traefik). It inspects service endpoints and maps routes, applies authentication/authorization rules, and injects rate limiting, caching, and transformation policies. It also recommends logging, health checks, and SSL termination settings to harden production deployments.

When to use it

• Setting up a centralized gateway for microservices in staging or production.
• Implementing authentication and JWT authorizers at the edge.
• Applying global rate limiting and IP throttling to protect backends.
• Adding request/response transformations for protocol or payload compatibility.
• Standardizing logging, health checks, and SSL termination across services.

Best practices

• Authenticate and authorize at the gateway level to reduce trust surface across services.
• Implement global rate limiting and per-route throttling to prevent noisy neighbors.
• Enable structured request and response logging for observability and tracing.
• Use health checks and circuit breaking to avoid routing to unhealthy backends.
• Enforce HTTPS and never leak internal backend details in error responses.

Example use cases

• Deploy a Kong declarative YAML to expose /api/users and /api/orders with JWT auth and per-minute rate limits.
• Configure Nginx as a reverse proxy with upstream load balancing, keepalive, and response caching for public APIs.
• Create an AWS SAM resource with a JWT authorizer for Cognito-based authentication on API Gateway stages.
• Add request transformation rules to translate legacy client payloads to modern microservice formats.
• Apply a global rate-limiting policy and logging plugin to detect API abuse and assist incident response.