In plain language
It is the front door every API request passes through before reaching the system behind it.
Example
Incoming webhook calls hit an API gateway that checks a key, limits request rates, and forwards valid calls to a processing function.
Related terms
API · Endpoint · Rate Limit · Authentication
Common misconception
An API gateway does not make the API behind it secure by itself; the backend must still validate inputs and permissions.
Implementation guidance
Centralize authentication and rate limits at the gateway, log requests for troubleshooting, set timeouts, and keep backend checks in place.