Does Backfire replace an API gateway?

No. It does not route traffic to your services, terminate mTLS between them or manage service discovery. It forwards specific outbound calls and meters them.

Yes, and plenty of teams do: the gateway handles internal and inbound traffic, while Backfire covers third-party calls where the target URL is not fully trusted.

Backfire vs an API gateway

Backfire compared with a full API gateway

API gateways are platform infrastructure: routing, auth, quotas, observability across everything you run. Backfire is one endpoint with one job. The right answer depends on whether you are buying a platform or solving a specific outbound problem.

When each one wins

If you need routing policy, service discovery, mTLS between services and a control plane, you need a gateway. If the problem is "our app calls third-party APIs and we do not trust the URL", Backfire is the smaller, faster answer.

Scope

The alternative: Whole platform
Backfire: Outbound HTTP calls

Setup

The alternative: Control plane, config, rollout
Backfire: One POST with a key

SSRF guard for arbitrary targets

The alternative: Typically your policy to write
Backfire: Built in

Metering unit

The alternative: Requests, seats or tiers
Backfire: Completed roundtrips

Audit of a single call

The alternative: Depends on your stack
Backfire: Full detail per attempt

Operational burden

The alternative: Significant
Backfire: None — it is a hosted endpoint

Dimension	The alternative	Backfire
Scope	Whole platform	Outbound HTTP calls
Setup	Control plane, config, rollout	One POST with a key
SSRF guard for arbitrary targets	Typically your policy to write	Built in
Metering unit	Requests, seats or tiers	Completed roundtrips
Audit of a single call	Depends on your stack	Full detail per attempt
Operational burden	Significant	None — it is a hosted endpoint

The same call, side by side

api-gateway

# the relay's whole surface: one target, one call
POST /functions/forward
{ "url": "https://partner.example.com/v1/orders", "method": "GET", "timeout_ms": 8000 }

# gateway territory, deliberately out of scope here:
# routing between your services, mTLS, service discovery,
# platform-wide quotas, multi-region failover

Worth knowing

A gateway can do everything Backfire does and much more, at the cost of owning and operating it. Backfire is deliberately not extensible: it does one thing and stops.
If your organisation already has an egress gateway with SSRF controls, use it. Duplicating policy in two places is worse than either alone.

Limits that stay your problem either way

No routing, mTLS or service discovery — the relay is one endpoint with one job, and stops there.
No platform-wide observability: you get per-call detail, not a map of everything you run.
Policy split across a gateway and the relay is worse than either alone. Give egress rules one home.
The relay is hosted with published limits rather than configurable ones; a gateway is tuned by you.

Questions about this

Other comparisons

Backfire vs a raw fetch Backfire vs your own proxy function Backfire vs an inbound tunnel Customer integrations Serverless egress Throughput in the docs

Try it with 5,000 free trips.

No card, no subscription, and the balance never expires.

Create an account Read the docs