> Are they worried about performance? Yes. You use a gateway to protect your service from unauthorized requests slowing everything down. A cluster of reverse p

> Are they worried about performance? Yes. You use a gateway to protect your service from unauthorized requests slowing everything down. A cluster of reverse proxies taking the impact of a denial of service attempt is exactly what you want. You also delegate the auth to another service so that attempts to log in and determining permissions does not slow down your core functionality. Auth headers and the identifier are passed from the internet user to the auth service via the proxy and it looks up the permissions on the given identifier for that user to confirm or deny the request. The API service on the backend doesn't necessarily need to know about any of this to be secure. It just needs to be walled off from everything that's not the gateway.