hello friends Welcome to reach goals today I have a very interesting question like
you know it's also an interview question too and it goes like this can you talk
about managing APA in your apps or somebody can ask like why do we need a
pap come on let us discuss more about this so the slide you see on the screen
is from the previous video which is a Twitter system design and let's see
where the API gates Wheatley sits over here right so this is our APA get me
so the API gateway is a single entry point where all the customer calls goes
and hits then API API decides to call with services and it gives the right
response to the customers right saying this I want to correlate the airport
security check with the API gate thing so if you correlate if I put security
check with the API gateway it does the same operation right if you if you look
at the security check at airport what it does is it validates and authenticates
the customer before or before going into the app work right so that means it does
a security check the next thing it does is it limits the entry of the passengers
into the airport right so let's say if the lot of crowd is there it we can
limit the number of passengers getting into the airport and we can divert it to
some other security check or security queue right and you if you want to count
the number of customers getting into the airport we can use this as an entry
point to figure out how many customers are getting into the airport right or
how many passengers are getting into the airport so API Gateway also does the
same thing it counts how many requests are coming in to the backend services
the security checkpoint also does the load balancing the entry for example if
you have an N number of passengers getting into the airport what it can do
is they can divert the passengers to different security queue in that way the
load gets balanced at one security checkpoint right so the same thing is
done by the API API right so let's talk about why do we need the AP AP
so the first point I have is internal AP / external EPS right so in your company
you may be having an internal customers and we also have an external customers
let's say if you want to remove if you want to restrict certain ApS only to the
internal customers or if you want certain ApI to be exposed to the
external customers we can have the configuration in the AP AP in such a way
the API are restricted only to the external customer versus the internal
customers right so let me give an example for example if you have a
customer service system or the internal customer data within your within your
company and you want to expose only those information on to the internal
customers site or internal applications then you can go and set up a
configuration in such a way these CPS can be used only for the internal
customers right the second thing I have is like an AP Analytics AP analytics is
a very important thing when you consider any kind of a software application or
the web services right so there are multiple reasons you want to know about
the analytics data let's me let me give an example right so for example if I
want to know how is the EPA traffic coming into the system right
second thing is which ap is used frequently and you may there may be a
question like who is the most frequently used developer right and similarly we
can also significant out like which ap slower which GP is faster right or so
all this information or all this information or logged into the system
and the analytical system helps us to get all those information right so other
other thing there's another example I can give is you know like geographically
from which location the APS are targeted or from which location most number of
ApS are used by so those are the analytical information which which we
can use from the AP again thing the third point I have is the AP security
right so all the APS has to be secured without any doubt right so we can apply
the security in multiple ways we have to authenticate we have to authorize the AP
AP and we had to do the rate-limiting and there are cases where you have to
give their own based control we can set up a lot of policy within the AP AP to
achieve all those things right so let us talk about what is what is
authentication so we might be having an API in our services and we want to
authenticate the users before even trying to get access
to the AP so we can apply the authentication policies right so what is
authorization a similar to authentication there may be cases where
we have to restrict only certain number of users to use the APS there we can set
up a authorization policies what is the rate limiting so rate limiting is you
know at within a few seconds you are a PA maybe target at like there is a DDoS
attack right so in that case we don't want to expose our ap and you don't want
to breach the security so we can apply the rate-limiting policy add ap a
gateway to make sure it's to make sure that we are limiting the number of
requests to the any of the AP so similarly we have a role based or a role
based control so there is an EP where only certain number of users are allowed
to read and read or write right so in this way we can apply the rule based
policy to achieve all our security principles right so that is what I call
the API gateway is a single point of entry to apply all your security right
so the next one I have is a load balancing so I have on another video
about the load balancing within this channel so I would like you to go and
look into that gate and get more details about it right so the next one is
circuit breaking let's say there is a request coming to your service and your
service is not responding at one point of time you know if it is going if it is
going to take too long we have to disconnect that so that is where circuit
breakers come into the picture and we can configure in such a way let's say
hey this ap is taking more than two seconds so our this ap isn't taking more
than five hundred milliseconds we can set up the configuration and we can
break that API and we can go into the next ap that's why the circuit breaking
principles are apply in the API gateway level right so the last state M I have
is a developer put developer portal is very important when we look for an AP
gateways right so with the help of a developer portal we can have all the
documentation we can configure the signatures or the keys where the
customers can use it right so when you want to have a right API gateway you
know you had to look for all these informations when you are configure
within within your system right
so let's talk about API management tools the first one I have is a a PG which is
from Google and it is one of the most popular API management tool right
I have personally worked on that and it has lot of flexibility and features for
high volume systems and this is also another popular tool which you called us
engine X plus which is from m5 right I have not worked in this but it is
popular with the cloud environment right and we have tyk which is the open source
and you can freely download that and install and try right and if you are
using AWS and there is a ready-made tool which is from a AWS which is Amazon API
management you have all the features or most of the features are covered in the
Amazon API management tool train thank you very much that's it I have bye