Three things you put in front of services — and they are often layered, not either/or.
A load balancer spreads traffic across healthy targets for availability and scale. A reverse proxy is a general-purpose intermediary you fully control — routing, TLS, caching, rewriting. An API gateway is a managed product for publishing and governing APIs — auth, API keys, throttling, transformation, OpenAPI. They are commonly layered (gateway in front of a load balancer in front of services), not a single choice. The deciding factor is how much API-product governance you need.
| Criterion | API gateway | Reverse proxy | Load balancer |
|---|---|---|---|
| Primary purpose | Publish and govern APIs | A general-purpose request intermediary | Spread traffic across healthy targets |
| OSI layer | L7 — HTTP / REST / WebSocket | L7 | L7 (ALB) or L4 (NLB) |
| Auth & API keys | Built in — IAM, Cognito, Lambda authorizers, API keys | Manual configuration | ALB: OIDC/Cognito. NLB: none |
| Rate limiting | Built in — throttling, usage plans, quotas | Manual (e.g. limit_req) | Not provided |
| Transformation | Yes — mapping templates and parameter mapping | Manual header / URI rewriting | None |
| API-product management | OpenAPI import/export, SDK generation, stages | None | None |
| Who operates it | Fully managed by AWS | You operate the server / process | Fully managed by AWS |
| Typical placement | Edge entry point for APIs | Any hop you control | In front of a fleet, often behind a gateway |