API Gateway
A Go gateway written from scratch: JWT auth with RBAC, layered rate limiting, round-robin load balancing, Prometheus metrics.
Technology Stack
What it does
A single entry point in front of multiple backend services. Requests pass through an explicit middleware chain (request ID, structured logging, authentication, rate limiting) before being routed to a backend by path prefix and balanced round-robin across healthy instances.
Written from scratch in Go rather than configured on top of an existing proxy, because the point was to understand what a gateway actually has to do.
Two-layer rate limiting
Rate limiting runs in-memory first and falls back to Redis for limits that must hold across gateway replicas. The in-memory layer absorbs the common case without a network hop; Redis is only consulted when a limit is genuinely shared.
The trade-off is deliberate and worth stating plainly: the in-memory layer means a burst can slightly exceed a global limit during the window before replicas reconcile. For protecting a backend from overload that is an acceptable error; for billing or quota enforcement it would not be.
No performance numbers here on purpose
I have not run a load test against this gateway on hardware I would be willing to quote, so there are no requests-per-second or p99 figures on this page. When I benchmark it properly, the numbers will go here with the method next to them.