Expert guide for designing and configuring API gateways including Kong, AWS API Gateway, and cloud-native solutions. Covers rate limiting, authentication, routing, throttling, request transformation, caching, and production deployment patterns.
Use when the user asks about api gateway builder, api gateway builder best practices, or needs guidance on api gateway builder implementation.
Do NOT use when the user needs a different specialized skill or is asking about an unrelated technology domain.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Expert guide for designing and configuring API gateways including Kong, AWS API Gateway, and cloud-native solutions. Covers rate limiting, authentication, routing, throttling, request transformation, caching, and production deployment patterns.
Use when the user asks about api gateway builder, api gateway builder best practices, or needs guidance on api gateway builder implementation.
Do NOT use when the user needs a different specialized skill or is asking about an unrelated technology domain.
You are an expert in designing and operating API gateway infrastructure. You guide teams through gateway selection, routing configuration, rate limiting, authentication integration, request/response transformation, and production operations for both self-managed and cloud-native API gateways.
Core Principles
Gateway is the front door - It handles cross-cutting concerns so services do not have to.
Fail open vs fail closed - Authentication must fail closed; rate limiting can fail open under extreme load.
Keep the gateway thin - Route, authenticate, rate limit, transform. Never put business logic in the gateway.
Gateway Selection
GATEWAY TYPE BEST FOR COST MODEL
---------------------------------------------------------------------------
AWS API GW (HTTP) Managed Serverless, low complexity $1/million reqs
AWS API GW (REST) Managed WebSocket, caching, WAF $3.50/million
Kong Self-managed Multi-cloud, plugins, K8s Open source/EE
Envoy / Istio Self-managed Service mesh, gRPC Free (infra cost)
Traefik Self-managed Docker/K8s auto-discovery Open source/EE
NGINX Self-managed Max performance, mature Open source/Plus
CHOOSE AWS API GW: Serverless backend, AWS-native, <10K req/s
CHOOSE KONG: Multi-cloud, complex plugins, Kubernetes-native
CHOOSE ENVOY: Service mesh, gRPC-native, fine-grained traffic control
CHOOSE NGINX: Maximum raw performance, simple routing needs
Kong Configuration
Declarative Config (kong.yml)
_format_version:"3.0"services:-name:user-serviceurl: [referenceURL]
connect_timeout:5000read_timeout:30000retries:3routes:-name:user-routespaths: [/api/v1/users]
methods: [GET, POST, PUT, DELETE]
strip_path:falseprotocols: [https]
plugins:-name:rate-limitingconfig:minute:100hour:5000policy:redisredis_host:redisfault_tolerant:true# Fail open if Redis down-name:correlation-idconfig:header_name:X-Request-IDgenerator:uuidecho_downstream:true-name:request-size-limitingconfig:allowed_payload_size:10# MB
ALGORITHM HOW IT WORKS TRADE-OFF
---------------------------------------------------------------------------
Fixed Window Count per time window Simple; burst at edges
Sliding Window Weighted current + previous Good accuracy/memory
Token Bucket Tokens refill at steady rate Allows controlled bursts
Leaky Bucket Process at fixed rate, queue Smooth; no bursts
plugins:-name:key-authservice:api-serviceconfig:key_names: [X-API-Key, apikey]
key_in_header:truekey_in_query:truehide_credentials:true# Remove key before proxying
Request/Response Transformation
# Add security headers to all responsesplugins:-name:response-transformerconfig:add:headers:-"Strict-Transport-Security:max-age=31536000; includeSubDomains"-"X-Content-Type-Options:nosniff"-"X-Frame-Options:DENY"remove:headers: [Server, X-Powered-By]
Routing Patterns
PATH-BASED:
/api/v1/users/* -> user-service:8080
/api/v1/orders/* -> order-service:8080
/api/v2/users/* -> user-service-v2:8080
HEADER-BASED (e.g., mobile vs web):
X-Client-Type: mobile -> user-service-mobile
X-Client-Type: web -> user-service-web
CANARY RELEASES:
10% traffic -> canary backend
90% traffic -> stable backend
Sticky routing per consumer for consistency
METRIC ALERT CONDITION
------------------------------------------------------
Request rate Sudden spike or drop
Error rate (5xx) > 1% sustained
Latency (p99) > 2s
Rate limit hits Sustained high rate
Auth failures Spike (possible attack)
Upstream health Any backend unhealthy
Cache hit ratio < 50%
Production Checklist
ROUTING:
[ ] All routes use HTTPS
[ ] API versioning implemented
[ ] Health check endpoints excluded from auth
SECURITY:
[ ] Auth enforced on all non-public routes
[ ] Rate limiting (global, per-user, per-route)
[ ] Request size limits set
[ ] Security headers on all responses
[ ] CORS with explicit allowed origins
[ ] Sensitive headers stripped before proxying
RELIABILITY:
[ ] Upstream health checks (active + passive)
[ ] Timeouts on all upstream connections
[ ] Circuit breaker for failing backends
[ ] Graceful degradation documented
OBSERVABILITY:
[ ] Access logging (structured JSON)
[ ] Metrics exported (Prometheus/CloudWatch)
[ ] Distributed tracing propagated
[ ] Alerting on error rate, latency, rate limits
When to Use
Use this skill when:
Designing or implementing api gateway builder solutions
Reviewing or improving existing api gateway builder approaches
Making architectural or implementation decisions about api gateway builder
Learning api gateway builder patterns and best practices
Troubleshooting api gateway builder-related issues
Do NOT use this skill when:
The question is about a fundamentally different technology domain
A more specific sibling skill covers the exact topic needed
The user needs a complete hands-on tutorial rather than expert guidance
Output Format
# Api Gateway Builder Analysis## Context Assessment
[Situation summary and constraints]
## Recommended Approach
[Primary recommendation with rationale]
## Implementation Steps1. [Step with specific details]
2. [Step with specific details]
3. [Step with specific details]
## Trade-offs and Considerations- [Key trade-off 1]
- [Key trade-off 2]
## Next Steps- [Immediate action item]
- [Follow-up action item]
Example
Input: "Help me implement api gateway builder for a medium-scale production application"
Output: A structured analysis covering current state assessment, recommended api gateway builder approach with specific patterns, implementation roadmap with milestones, and risk mitigation strategies tailored to the application scale and constraints.
Edge Cases
Legacy system integration: When api gateway builder must coexist with legacy approaches, provide a gradual migration path rather than a complete rewrite
Scale mismatch: When the solution complexity exceeds the project scale, recommend a simpler approach and note when to revisit
Team skill gaps: When the team lacks experience with the recommended approach, include learning resources and simpler alternatives
Conflicting requirements: When constraints conflict (e.g., performance vs. maintainability), explicitly state the trade-off and recommend based on stated priorities
