[sytringy05]

the same benefit you get from most reverse proxies. If you dont need it, then nothing. If you do need it, it's critical.

If you: - have more than 1 upstream service to hide behind your api.bigcorp.com name? - want to enforce standard authn/authz patterns across lots of teams/backend services? - want a standard approach to all the Quality of Service management? - want to have a well defined lifecycle for your APIs? - want to have a portal that describes the APIs, how they work and facilitate users getting access to them?

API Gateways are a thing because web servers that started out being used as reverse proxies were not that easy to configure and just did way too much web server stuff. API gateways made this easier, and added a host of security measures to make it somewhat safer when presenting APIs to the internet.

Then API management came along as a first class concern for orgs who want others to use their APIs.

It's good to see some FOSS innovation in this domain, most of the real open source API gateways are a huge mess. Kong is great, but the really useful stuff is part of the paid enterprise platform.

[jjzhiyuan]

Hi, could you please share more about “the really useful stuff” part?

[beoberha]

I’m assuming he means things like third party auth connectors

[sytringy05]

the main ones are OIDC plugin, the serverless plugin, advanced req and resp transformer plugins. auth connectors are useful, but most orgs I work with are using OIDC or SAML