Configure API gateway routing, authentication and authorisation policies for a multi-service backend.
Information & Communications Technology
API Gateway Management and Rate Limiting Strategies
Configure API gateways for routing, authentication and rate limiting, applying token bucket and sliding window strategies to protect backend services.
🗓️Duration5 training days
📚Content4 modules · 8 sessions
🎓On completionAccredited attendance certificate
About the programme
Course Overview
An API gateway sitting in front of a growing set of backend services becomes the single place where authentication, quota enforcement and traffic shaping either protect the platform or quietly become its biggest bottleneck. This course covers configuring an API gateway for reliable routing and securing it with modern authentication schemes, then focuses in depth on rate limiting strategy: how token bucket, leaky bucket and sliding window algorithms behave differently under bursty traffic, and how to choose between them for a given API's usage pattern. Participants design tiered quota structures that differentiate free, standard and enterprise consumers, and configure throttling responses that give client applications the information they need to back off gracefully. Sessions also cover circuit breaking and backend protection patterns that prevent a single overloaded service from cascading failure through the gateway, API versioning strategies that let consumers migrate without a hard cutover, and building a developer portal with API keys, usage dashboards and documentation that reduces support load. The course closes with capacity testing a gateway configuration under realistic burst and sustained load.
Expected Learning Outcomes
Compare token bucket, leaky bucket and sliding window rate limiting algorithms for different traffic patterns.
Design tiered quota structures that differentiate consumer classes without penalising legitimate bursts.
Configure throttling responses and headers that let client applications back off gracefully.
Apply circuit breaker patterns that protect backend services from cascading overload failures.
Design API versioning strategies that allow consumer migration without a disruptive hard cutover.
Build a developer portal with API key management, usage dashboards and self-service documentation.
Who Should Attend
API platform engineers responsible for gateway configuration and policy design.
Backend service owners exposing APIs to internal or external consumers.
Integration architects designing authentication and rate limiting for partner APIs.
DevOps and site reliability teams protecting services from traffic overload.
Product managers overseeing API monetisation and tiered access plans.
Developer relations staff supporting external API consumers through a portal.
Course Modules
Select any module to see its sessions and points.
01API Gateway Configuration Fundamentals
2 sessions · 8 points
Session 1Routing, Authentication and Authorisation Policy Design
- Configure request routing rules that direct traffic to the correct backend service and version.
- Set up OAuth 2.0 and JSON Web Token based authentication policies at the gateway layer.
- Design fine-grained authorisation rules that restrict specific endpoints to permitted consumer scopes.
- Centralise cross-cutting concerns such as logging and header injection at the gateway rather than each service.
Session 2API Versioning and Backward Compatibility Strategy
- Choose between URI, header and content-negotiation based API versioning approaches.
- Design deprecation timelines and communication plans for retiring older API versions.
- Route traffic between concurrent API versions during a phased consumer migration.
- Maintain backward-compatible response contracts to avoid breaking existing integrations.
02Rate Limiting Algorithm Design
2 sessions · 8 points
Session 1Token Bucket and Leaky Bucket Rate Limiting
- Explain how the token bucket algorithm allows controlled bursts while enforcing an average rate.
- Explain how the leaky bucket algorithm smooths bursty traffic into a steady outbound rate.
- Select bucket size and refill rate parameters appropriate to typical and peak consumer behaviour.
- Compare algorithm behaviour under sustained overload to choose the right fit for each API.
Session 2Sliding Window and Distributed Rate Limiting
- Implement sliding window counters that avoid the burst edge effects of fixed window limiting.
- Design distributed rate limiting that stays consistent across multiple gateway instances.
- Handle clock synchronisation and shared state challenges in distributed limiting implementations.
- Benchmark rate limiting overhead to ensure it does not become a latency bottleneck itself.
03Quota Management and Backend Protection
2 sessions · 8 points
Session 1Tiered Quota Design and Throttling Responses
- Design tiered quota plans that differentiate free, standard and enterprise consumer classes.
- Configure throttling response codes and rate limit headers that guide client retry behaviour.
- Set burst allowances that accommodate legitimate traffic spikes without opening abuse loopholes.
- Monitor quota consumption patterns to identify consumers approaching plan upgrade thresholds.
Session 2Circuit Breaking and Cascading Failure Prevention
- Apply circuit breaker patterns that stop routing traffic to a backend service showing sustained failures.
- Configure fallback responses and graceful degradation when a dependent service is unavailable.
- Set health check and recovery thresholds that reopen a circuit once a service stabilises.
- Test failure injection scenarios to confirm circuit breakers behave correctly under real outages.
04Developer Experience and Capacity Validation
2 sessions · 8 points
Session 1Building a Developer Portal for API Consumers
- Design a developer portal offering API key issuance, documentation and interactive testing.
- Build usage dashboards that show consumers their quota consumption and error rates.
- Publish clear rate limiting and versioning policies to reduce support ticket volume.
- Collect consumer feedback through the portal to prioritise future API improvements.
Session 2Load Testing and Capacity Validation for Gateway Configurations
- Design load tests that simulate realistic burst and sustained traffic against the gateway.
- Measure gateway latency overhead introduced by authentication and rate limiting policies.
- Identify capacity limits and scaling triggers before a configuration reaches production traffic.
- Validate rate limiting and circuit breaker behaviour under simulated backend failure conditions.
What the participant receives
4 course modules
A structured syllabus
8 training sessions
across 5 days
32 detailed points
Applied, detailed content
Accredited attendance certificate
On completing the programme
Complete your registration
We will contact you within one business day to confirm.
Ready to start?
Reserve your seat and start building the skill.