Envoy

Answer-First: Combining internal gRPC transport with an automated REST JSON Gateway (grpc-gateway) provides sub-millisecond HTTP/2 inter-service RPC performance while exposing standard OpenAPI/REST endpoints to web/mobile clients, guaranteed through Protocol Buffer contract linting and backward-compatible schema versioning. Parent Architecture Guide: This article is part of our pillar series on Ecommerce Architecture & Composable Migration. The sequence diagram below illustrates the end-to-end request lifecycle as an external REST/JSON HTTP client payload is transcoded by the API Gateway into high-performance gRPC Protobuf binary calls across internal microservices. ...

API rate limiting defends backend services by restricting request volume. Security requires a layered defense: Web Application Firewalls (WAF) block edge-level volumetric spikes, API Gateways manage L7 credentials and quotas, and application middleware enforces fine-grained business limits. Client identification must rely on validated, secure IP parsing (using the PROXY protocol or rightmost X-Forwarded-For checks). Prerequisite: This is Part 11 of the System Design Masterclass. Previous parts built the core components — this part covers securing APIs and managing client traffic spikes at scale. ...