Why Kong API Gateway Is a Scalable, Extensible Backend Solution

Kong is an open‑source API gateway created by Mashape, built on OpenResty (NGINX + Lua). It runs on NGINX with either Apache Cassandra or PostgreSQL for storage, offering a RESTful API for managing and configuring API services, and can scale horizontally across multiple Kong servers via load balancing.

Core Components

Kong Server: an NGINX‑based server that receives API requests.

Apache Cassandra/PostgreSQL: databases used to store operational data.

Kong Dashboard: the official UI for management, with an alternative RESTful admin API.

Key Features

Scalability: add more servers to achieve horizontal scaling and handle high request volumes.

Modularity: extend functionality by adding plugins that can be configured via the RESTful Admin API.

Infrastructure Agnostic: deploy on cloud, on‑premises, single or multiple data centers, supporting public, private, or invite‑only APIs.

Plugin Architecture

Kong’s plugin system allows custom functionality written in Lua to run at various points in the request/response lifecycle. Built‑in plugins include:

Authentication: Basic, Key, OAuth2.0, HMAC, JWT, LDAP.

Security: ACL, CORS, dynamic SSL, IP restriction, bot detection.

Traffic Control: request rate limiting, upstream response limiting, request size limits (local, Redis, or cluster modes).

Analytics & Monitoring: Galileo, Datadog, Runscope.

Protocol Transformation: request/response modification before forwarding.

Logging: TCP, UDP, HTTP, File, Syslog, StatsD, Loggly, etc.

Request Processing Flow

A typical API request passes through Kong as follows:

Kong receives the request on a Kong Server.

The request is routed to the appropriate upstream API.

Configured plugins execute during the request/response cycle, handling authentication, rate limiting, transformation, logging, and other concerns.

The response from the upstream service travels back through Kong, where response‑side plugins can modify or log it before it reaches the client.

Conclusion

Kong provides a rich set of default plugins for API management and supports horizontal clustering to increase throughput. Built on OpenResty, it can be extended with custom Lua plugins to add advanced features such as per‑API timeouts, retries, fallback strategies, caching, API aggregation, and A/B testing.

While Kong covers many enterprise‑grade needs out of the box, certain capabilities require custom development, highlighting its flexibility for complex API gateway scenarios.