Multi-tenant API Gateway
Go-based API gateway replacing an NGINX bottleneck. Per-tenant rate limits, OAuth2, and a single observable choke point.
About this project.
A Go-based, observable API gateway built to replace an aging NGINX routing layer for a fintech platform.
Tech Stack
- Go Gateway core
- OAuth2 / mTLS Auth
- OpenTelemetry Observability
- Kubernetes Runtime
Project Info
Key Features
Per-tenant control
OAuth2 token introspection, per-tenant rate limits, quota enforcement, and request shaping.
Observable edge
End-to-end OpenTelemetry traces with per-route SLO dashboards and error budgets in Grafana.
Hardened
mTLS between gateway and upstreams, WAF rules per tenant tier, auto-revocation on compromised tokens.
Zero-downtime cutover
Shadow traffic mirroring for two weeks, per-route gradual rollout, rollback in under 60 seconds.
Smart routing
Weighted routing, canary splits, header-based experiments without redeploying upstream services.
Secrets discipline
Vault-issued short-lived credentials for upstream services, with rotation hooks and audit trail.
Feature set
Per-tenant control
- OAuth2 token introspection
- Per-tenant rate limits + quotas
- Request shaping & rewriting
Observable
- OpenTelemetry traces end-to-end
- Per-route SLO dashboards
- Error budgets surfaced in Grafana
Hardened edge
- mTLS between gateway and upstreams
- WAF rules tuned per tenant tier
- Auto-revocation on compromised tokens
Zero-downtime cutover
- Shadow traffic mirroring for 2 weeks
- Per-route gradual rollout
- Rollback in under 60 seconds
You might also like.
Headless E-commerce Migration
Magento → headless Next.js migration. Core Web Vitals all-green, mobile conversion 2x in 90 days post-launch.
View project