Building a Lightweight API Gateway with Envoy (Without the Complexities)

Static routes, rate limiting, and authentication filters via Lua scripting — no service mesh, no control plane, just a config file and a plan.

A few months back, our squad hit a familiar wall. We had six backend services — a mix of Go microservices handling payments, KYC, and merchant onboarding — and every single one of them was reinventing the same three things: routing, rate limiting, and token validation. Copy-pasted middleware everywhere. One service had a rate limiter bug that let a partner integration hammer our KYC endpoint until it fell over. That was the last straw.

The obvious answer was “put a gateway in front of everything.” The less obvious part was picking one that wouldn’t turn into a second job to operate.

We looked at Kong, Istio, and a couple of managed API gateway products first. Kong needed a database (or a not-quite-mature DB-less mode at the time) and its own admin API to babysit. Istio meant buying into an entire service mesh — sidecars, mTLS everywhere, a control plane, and a learning curve steep enough that half the team would’ve spent a sprint just reading docs. For six services and a few hundred requests per second, that felt like bringing a container ship to move a couch.