API Composition (BFF) vs API Gateway
An API gateway sits in front of your services to route, authenticate, and rate-limit requests, usually passing each request to one backend. An API composition layer, often called a Backend for Frontend, calls several upstream APIs in parallel and returns one merged, client-shaped response. Gateways solve traffic management; composition solves chatty clients and payload shape. Many teams run both.
API composition (BFF)
One endpoint per screen or client that fans out to several APIs, merges the results, and returns only the fields that client needs.
API gateway
A front door that routes each request to a backend service and applies auth, quotas, and logging.
Side-by-Side Comparison
| Dimension | API composition (BFF) | API gateway |
|---|---|---|
| Primary job | Merge and reshape responses for a client | Route, authenticate, and throttle traffic |
| Calls per client request | Many upstream calls, in parallel | Usually one backend per route |
| Response shape | Tailored to the screen | Whatever the backend returns |
| Third-party APIs | First-class, with vaulted credentials | Possible, but focused on your own services |
| Effect on mobile latency | Removes sequential round trips | Neutral; client still makes each call |
Choose API composition (BFF) when
- A single screen needs data from several APIs.
- Mobile clients suffer from network waterfalls.
- You integrate third-party APIs more than internal services.
Choose API gateway when
- You expose many internal microservices and need one policy layer.
- Your main problem is auth, quotas, and routing, not response shape.
Frequently Asked Questions
Can an API gateway do composition?
Some gateways support basic aggregation plugins, but they are built for routing and policy. Complex merging, field mapping, and per-client shaping are easier in a dedicated composition layer.
Should the BFF sit behind or in front of the gateway?
Commonly in front: clients call the BFF, which calls internal services through the gateway and third-party APIs directly with injected secrets.
Recipes That Apply This Pattern
Sources & Definitions Used in This Answer
- DefinitionAPI Composition
- DefinitionAPI Gateway
- DefinitionBackend for Frontend (BFF)
- DefinitionAPI Aggregation
- DefinitionUpstream Fan-out
- DefinitionNetwork Request Waterfall
- Stack guideREST APIs safe & unsafe practices
- Stack guideMobile Apps safe & unsafe practices
- Stack guideWeb Frontends safe & unsafe practices
Try the edge approach on your own APIs
Clone a recipe, add your upstream keys to the vault, and call one endpoint from your client.