API Gateway

An API gateway is a software layer that sits in front of an organisation's application programming interfaces and acts as the single entry point for calls from outside. Every request, whether from a mobile app, a partner fintech or a merchant's server, reaches the gateway first. The gateway checks who is calling, decides whether the call is allowed, applies limits, forwards it to the right internal service and records what happened.

In financial services, API gateways became standard as banks and payment firms opened their systems to third parties through API banking, open banking and banking-as-a-service (BaaS). The gateway is a general technology component, offered by cloud providers and software vendors, rather than a financial product, but its security settings are closely examined by regulators and auditors in banks.

Think of the reception desk in a large office building. Visitors do not wander the corridors looking for the person they want. They stop at reception, show identification, say who they are visiting, get a badge for the floors they are allowed on, and are pointed to the right lift. The receptionist also keeps a visitors' book.

An API gateway is that reception desk for computer systems. Apps and partners that want something from a bank, such as a balance or a payment, all arrive at the same front door. The gateway checks their pass, refuses anyone without one, stops callers who knock too often, and sends each request to the correct back-office system. The systems behind it can then focus on their own jobs.

• Authentication and authorisation. It verifies the caller's credentials, commonly OAuth 2.0 access tokens, API keys or client certificates, and checks the scope of what the caller may do. This is the security sense of authorization, not card authorization.
• Transport security. It terminates encrypted connections using Transport Layer Security (TLS), often with mutual TLS so both sides prove their identity with certificates.
• Rate limiting and quotas. It caps the number of calls a client may make per second or per day, protecting core systems from overload and from denial-of-service attacks.
• Routing and versioning. It sends each request to the right internal service, which may be a modern microservice or a legacy core banking system, and lets old and new API versions run side by side.
• Transformation. It can translate between formats, such as JSON from a fintech app and older XML or fixed-length formats used internally.
• Logging and monitoring. It records every call for audit, billing, fraud analysis and incident investigation.

Take a payment initiation call from a licensed third party under PSD2. The third party's server opens a mutual TLS connection to the bank's gateway, presenting a qualified certificate. The gateway validates the certificate and the OAuth token, which reflects the customer's consent, and confirms that the token covers payment initiation for that account. It checks the client's rate limit and inspects the request for malformed data. It may require an idempotency key so that a repeated request does not create a duplicate payment. Only then does it pass the request to the payments service, return the response and write the log entry. If the payment's status later changes, the bank may notify the third party through a webhook notification sent out through the same perimeter.

Under the EU's PSD2, banks must offer licensed account information and payment initiation providers a secure way to access payment accounts, and most do this through a dedicated open banking API exposed via a gateway. In the UK, the Open Banking Standard sets technical and security profiles that bank gateways implement, and many ecosystems follow the OpenID Foundation's Financial-grade API (FAPI) security profile. Card processors, payment gateways and stablecoin issuers use API gateways in the same way to serve merchants and partners.

The term "payment gateway" causes confusion. A payment gateway is a financial service that captures and forwards card or account payments. An API gateway is a technical traffic manager that can sit in front of any kind of API, including a payment gateway's own.

• Single point of failure. Because all traffic passes through it, a gateway outage cuts off every partner at once, so firms run it in several data centres or cloud zones.
• Misconfiguration. Weak token checks or an exposed internal route can leak data, as many data breaches have shown. Gateways are only as strong as their policies.
• Added latency. Each check adds milliseconds, which matters for card authorization and instant payments.
• Not a full security programme. A gateway does not replace secure coding, third-party risk reviews, key management in a hardware security module (HSM) or fraud monitoring behind it.

• OpenID Foundation
• Open Banking Limited