Could be any number of outside endpoints as well. Imagine a dev shop with several teams, all building external facing apis. In this scenario you don’t want eac

Could be any number of outside endpoints as well. Imagine a dev shop with several teams, all building external facing apis. In this scenario you don’t want each team to reinvent the “external access, auth, audit & accounting” as well as rate limiting stuff. It would take a lot of resources and probably end up insecure at places. An API gateway gives you a convention and pluggable authentication system for the teams to consume and not worry about. At least in theory. Something like that. :)