Secure API Gateway with Rate Limiting and JWT Authentication

Abstract: APIs form the foundation of modern applications, yet they remain highly vulnerable to various attacks such as brute force, token abuse, and DDoS. In this paper, we present a layered approach to secure APIs using API gateways, JWT-based authentication, and rate limiting. Through comparative analysis of tools like AWS API Gateway, Kong, Apigee, and NGINX, we highlight key features, strengths, and trade-offs. Our findings suggest that integrating JWT with rate limiting significantly improves API security and scalability across architectures