API Gateway vs Reverse Proxy: Nginx, Kong, Rate Limiting, and Authentication

Modern applications are much more complex than before. A single app may have:

• Mobile applications

• Web frontends

• APIs

• Multiple backend services

• Cloud infrastructure

• Databases

• Third-party integrations

As traffic grows, managing security, performance, authentication, and API requests becomes difficult.

This is where Reverse Proxies and API Gateways become important.

Although many people think they are the same thing, they actually solve different problems.

In this article, we will learn:

• What a Reverse Proxy is

• What an API Gateway is

• Differences between them

• How Nginx and Kong work

• Authentication and Rate Limiting

• Real-world examples

• Simple code examples

What is a Reverse Proxy?

A Reverse Proxy is a server that sits between users and your backend application. Instead of users directly talking to your backend server, requests first go to the reverse proxy. The reverse proxy then forwards the request to the correct backend server.

Simple Example

The user never directly accesses your backend server.

Why Use a Reverse Proxy?

Reverse proxies help improve:

• Security

• Performance

• Scalability

• Load balancing

1. Load Balancing

Suppose your application becomes popular and one server is not enough anymore. You can run multiple backend servers. The reverse proxy distributes traffic between them.

This prevents one server from crashing due to high traffic.

2. SSL Handling (HTTPS)

Instead of configuring HTTPS on every backend server, Nginx can handle SSL for all servers.

Example

This makes deployment easier.

3. Better Security

A reverse proxy hides your real backend servers.

Benefits include:

• Hidden server IPs

• DDoS protection

• Firewall integration

• Traffic filtering

Attackers cannot directly access backend servers.

Simple Nginx Reverse Proxy Example

Here is a simple Nginx configuration:

server {
    listen 80;

    location / {
        proxy_pass http://localhost:3000;
    }
}

What This Does

• Nginx listens on port 80

• Requests are forwarded to a backend app running on port 3000

What is an API Gateway?

An API Gateway is also a middle layer between users and backend services. But it does much more than forwarding traffic. It helps manage APIs.

API Gateway Features

An API Gateway can handle:

• Authentication

• Authorization

• Rate limiting

• API logging

• Monitoring

• API versioning

• Request transformation

API Gateways are commonly used in microservices.

API Gateway Example

Instead of talking to many backend services directly, everything goes through the API Gateway.

Why API Gateways are Useful

Imagine an e-commerce application.

Backend services:

• Login Service

• Product Service

• Payment Service

• Notification Service

Without an API Gateway:

Problems:

• Hard to manage authentication

• Security becomes inconsistent

• Difficult monitoring

• Complex frontend code

With an API Gateway:

Benefits:

• Centralized security

• Easier monitoring

• Unified authentication

• Better scalability

Reverse Proxy vs API Gateway

What is Nginx?

Nginx is one of the most popular reverse proxies and web servers.

It is fast, lightweight, and widely used.

Nginx is commonly used for:

• Reverse proxying

• Load balancing

• SSL handling

• Static file serving

• Caching

Nginx Load Balancing Example

upstream backend_servers {
    server 192.168.1.10;
    server 192.168.1.11;
    server 192.168.1.12;
}

server {
    listen 80;

    location / {
        proxy_pass http://backend_servers;
    }
}

What Happens Here?

Nginx automatically distributes traffic between multiple backend servers.

What is Kong?

Kong is an API Gateway built on top of Nginx.

It adds advanced API management features.

Kong Features

Kong supports:

• JWT Authentication

• OAuth2

• Rate Limiting

• API Analytics

• Logging

• Monitoring

• Plugin System

Kong is very useful for large-scale microservice systems.

Nginx vs Kong

When Should You Use Nginx?

Use Nginx when:

• You need a simple reverse proxy

• Your app architecture is small

• You mainly need SSL and load balancing

• You want lightweight infrastructure

Examples:

• Blogs

• Portfolio websites

• Small APIs

• Simple SaaS apps

When Should You Use Kong?

Use Kong when:

• You have many APIs

• You use microservices

• You need centralized authentication

• You need analytics and monitoring

• You want advanced API management

Examples:

• Enterprise applications

• FinTech systems

• E-commerce platforms

• Mobile backend systems

What is Authentication?

Authentication checks whether a user is allowed to access your API.

Without authentication:

• Anyone can access your APIs

• Sensitive data becomes vulnerable

Basic Authentication Example in Express.js

Install Package

npm install basic-auth-connect

Example Code

import express from 'express';
import basicAuth from 'basic-auth-connect';

const app = express();

app.use(
  basicAuth((user, pass) => {
    return user === 'admin' && pass === 'mypassword';
  })
);

app.get('/api', (req, res) => {
  res.json({
    message: 'Authenticated Successfully'
  });
});

app.listen(3000);

This protects your API using username and password authentication.

JWT Authentication with Kong

Kong supports JWT authentication using plugins.

Enable JWT Plugin

curl -X POST http://localhost:8001/services/example-service/plugins \
  --data "name=jwt"

Now users must send valid JWT tokens to access APIs.

What is Rate Limiting?

Rate limiting controls how many requests a user can make in a certain time.

Example:

• 100 requests per minute

• 1000 requests per hour

This helps prevent:

• DDoS attacks

• API abuse

• Excessive traffic

• Server overload

Rate Limiting Example in Nginx

http {
    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;

    server {
        location /api/ {
            limit_req zone=api_limit burst=20;
            proxy_pass http://backend;
        }
    }
}

What This Does

• Allows 10 requests per second

• Allows temporary bursts of 20 requests

Rate Limiting with Kong

curl -X POST http://localhost:8001/services/example-service/plugins \
  --data "name=rate-limiting" \
  --data "config.minute=100"

This limits users to 100 requests per minute.

Modern Architecture Example

A modern production setup may look like this:

Each layer solves different infrastructure problems.