API Gateway architecture
A gateway is an edge: auth, routing, and coarse aggregation. It should not become the place where business rules hide.
Personal experience
ProCrédito v2 puts an API gateway in front of Laravel microservices (security, settings, obligations, customers). The gateway authenticates and routes; it does not own obligation rules.
Technical perspective
Put at the edge what every request needs: TLS termination, authentication, rate limits, request IDs, routing. Do not put “how a discount is calculated” there. That rule belongs in a domain that can be tested without standing up the edge.
Backends-for-frontends are legitimate when a storefront and an admin console need different aggregates. They are not legitimate as a second domain layer that reimplements services.
Timeouts and retries belong at the gateway with a budget. Retrying a non-idempotent POST from the edge is how you double-charge. Propagate a correlation ID and stop inventing one in every service.
Architecture
Edge responsibilities, domain behind
Client
API Gateway
Auth, route, limits
Service A
Service B
Service C
Technical perspective. The gateway routes; services own the rules.