Internal API gateway consolidation

Four teams had each grown their own edge — different proxy configs, three different ways of validating a token, and logging that could not be correlated across a request that crossed teams. Nobody could answer basic questions like which services a given client actually called, and a rate limit set by one team was invisible to the others. The trigger was a security review that found one of the four was not checking token expiry at all, which had been true for about a year.

Platform engineer, technical lead on the consolidation. I did the design, negotiated the migration order with each team, and wrote most of the gateway configuration and the shared middleware.

I owned the gateway itself: routing, the token validation middleware, rate limit policies, and the structured access log with a correlation id threaded through. I built the traffic-mirroring setup that let each team see their real requests hitting the new gateway before any of it was live. I wrote the per-team migration guides and did the pairing sessions, which was more of the job than the code was. The Terraform for the whole thing is mine, including the parts I am not proud of.

I did not build a service mesh, which was the suggestion from one team. The problem was four inconsistent edges, not east-west traffic, and a mesh would have added an operational surface nobody was staffed to run. I chose a boring Nginx-fronted Go service over a commercial gateway mainly because our auth requirements were unusual enough that we would have been writing plugins anyway. The one thing I did insist on was that the gateway never makes a network call to validate a token — it verifies signatures locally against cached keys — because a gateway that depends on an identity service is a gateway that goes down when identity does.

No team could be asked to pause feature work, so migration had to be incremental and reversible per route. Two of the four edges had no test coverage at all, so parity had to be established by mirroring real traffic rather than by running a suite. We also had a hard date from the security review for the token expiry fix, which meant that one fix shipped as a patch to the old proxy first, out of order, before the consolidation reached it.

Four edges became one, and the eleven-hundred-odd routes across them ended up on one auth path with one log format. Median added latency at the gateway is about four milliseconds, which was the number I promised. The correlation id meant that a cross-team incident three months later took about twenty minutes to trace instead of the day it would have taken before. The security finding closed, and the follow-up review found no equivalent gaps.

Each of the four teams gave me an engineer for the week of their migration, and two of them ended up contributing rate limit policies back. Our security engineer wrote the token validation test cases and reviewed the middleware. The infrastructure lead reviewed the Terraform and rejected my first attempt at the module layout, correctly.