Learn GraphQL - API Gateway Patterns & Management

#Introduction

The larger an organization, the more services, clients, and teams need to be managed. Episode 33 discusses GraphQL Gateway and API Management — the layer that stands in front of your services and manages traffic, authentication, and usage limits.

We'll learn the gateway's responsibilities, use Kong Gateway, explore AWS AppSync and Hasura as managed solutions, and discuss API management comprehensively.

#GraphQL Gateway Architecture

#Gateway Layer Responsibilities

The gateway sits between clients and services. Its main responsibilities:

• Aggregation: combining many services into one endpoint (federation, episode 22).
• Authentication and authorization centralized in one place.
• Rate limiting and quotas to protect the backend.
• Caching of common query results.
• Centralized observability: logging, metrics, tracing.

The common pattern: clients only interact with the gateway; the services behind it are never directly exposed. This simplifies security and allows backend changes without affecting clients.

#Kong Gateway

#Setup and Plugins

Kong is an open-source API gateway that supports GraphQL. Run it via Docker:

docker run -d --name kong \
  -p 8000:8000 -p 8001:8001 \
  -e "KONG_DATABASE=postgres" \
  -e "KONG_PG_HOST=localhost" \
  kong:3.8

Then register the GraphQL service and route via the Kong Admin API, for example with curl -X POST http://localhost:8001/services -d name=graphql-api -d url=http://api:4000.

#Rate Limiting and Authentication Plugins

Add the rate limiting and key-auth plugins:

curl -X POST http://localhost:8001/services/graphql-api/plugins \
  -d name=rate-limiting \
  -d config.minute=100 \
  -d config.policy=local

curl -X POST http://localhost:8001/services/graphql-api/plugins \
  -d name=key-auth

With the key-auth plugin, every consumer must include an API key — consumer and key management is done via the Kong Admin API. Kong handles limiting and authentication before the request reaches the GraphQL server.

#AWS AppSync

#Managed GraphQL Service

AWS AppSync is a fully managed GraphQL service from AWS:

• Direct database integration: the schema connects directly to DynamoDB, RDS, or Aurora.
• Built-in real-time subscriptions, integrated with AppSync realtime.
• Offline sync for mobile apps — storing data while offline and syncing when online (episode 28).
• Integrated auth: Cognito, IAM, API key, and OpenID Connect.

AppSync fits when you're already on AWS and want to remove the operational burden of servers. Its trade-offs: vendor lock-in and VTL- or JavaScript-based resolvers that are less flexible than writing free-form resolvers.

#Hasura

#Instant GraphQL from a Database

Hasura generates a GraphQL API automatically from a PostgreSQL database. Setup:

docker run -d -p 8080:8080 \
  -e HASURA_GRAPHQL_DATABASE_URL=postgres://user:pass@host/db \
  -e HASURA_GRAPHQL_ADMIN_SECRET=rahasia \
  hasura/graphql-engine:latest

With a single command, Hasura reads the database schema and instantly provides queries, mutations, filters, aggregations, and subscriptions. Its main advantages:

• Permissions system based on role and session variables per user.
• Event triggers that call webhooks when data changes.
• Remote schemas to combine custom GraphQL with the Hasura API.

Hasura is great for getting started quickly at high speed, especially when your data lives in PostgreSQL. Its weakness: business logic still needs to be handled via remote schemas or actions.

#API Management

#API Keys and Usage Tracking

Regardless of the gateway used, API management requires:

• API keys: identifying each consumer, with permission policies per key.
• Usage tracking: record request count, latency, and errors per consumer.
• Analytics: identify the most expensive queries and heaviest consumers.
• Developer portal: documentation, self-service keys, and a playground for API consumers.

type UsageReport {
  consumerId: ID!
  requestCount: Int!
  totalCost: Float!
  period: String!
}

Many companies combine a gateway (Kong, Apollo Gateway) with a managed platform like StepZen or a full API platform that provides an integrated developer portal.

#Conclusion

Key takeaways:

• A gateway manages aggregation, authentication, rate limiting, caching, and observability.
• Kong handles rate limiting and key-auth with easily installed plugins.
• AWS AppSync is managed GraphQL with subscriptions and offline sync.
• Hasura generates instant GraphQL from PostgreSQL with built-in permissions.
• API management covers keys, usage tracking, and a developer portal.

In the next episode, episode 34, you'll learn about scaling GraphQL — vertical scaling with resource optimization, horizontal scaling with load balancing and stateless design, database scaling with read replicas and connection pooling, layered caching, scaling WebSocket subscriptions, and circuit breakers with bulkheads. Your API will be ready to serve millions of requests!