commerce-api-gateway

Aggregate commerce microservices behind a GraphQL federation gateway with authentication and rate limiting.

3|1|Updated Mar 21, 2026
One-click install
npx skills add https://github.com/tomtoto757/ecomm-ai-team --skill commerce-api-gateway-tomtoto757
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: commerce-api-gateway
Source: https://github.com/tomtoto757/ecomm-ai-team/tree/main/skills/platform-integrations-infrastructure/finsilabs/headless-modern/commerce-api-gateway
Command: npx skills add https://github.com/tomtoto757/ecomm-ai-team --skill commerce-api-gateway-tomtoto757

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires fastify, @fastify/caching, jsonwebtoken, rate-limiter-flexible, ioredis, @apollo/rover, @graphql-tools/wrap, @opentelemetry/sdk-node, @opentelemetry/exporter-trace-otlp-http, @opentelemetry/instrumentation-http, dataloader, undici.

What problem does it solve? Storefronts in composable commerce architectures often make 10+ API calls per page load across catalog, inventory, cart, and CMS services, creating latency, inconsistent authentication, and duplicated cross-cutting logic. This Skill provides patterns for building a single API gateway that unifies these services behind one entry point. ## Core Features & Use Cases - GraphQL Federation with Apollo Router: Compose catalog, inventory, and cart subgraphs into a unified supergraph using Rover CLI, with @key, @extends, and @external directives for shared entity types. - REST BFF with Fastify: Build composite endpoints (e.g., /api/pdp/:id) that call multiple upstream services in parallel with Promise.allSettled and graceful fallbacks for non-critical services. - Cross-Cutting Concerns at the Gateway: Apply JWT RS256 authentication, Redis-backed rate limiting, response caching, explicit CORS origins, and OpenTelemetry distributed tracing without modifying each microservice. - Use Case: A fashion retailer migrating from a monolith to composable commerce uses this Skill to consolidate 8-12 storefront API calls into single BFF endpoints, enforce per-user rate limits, and propagate trace context to all downstream services. ## Quick Start Ask the AI to build a Fastify BFF that aggregates catalog, inventory, and CMS services into a product detail endpoint with JWT auth and Redis rate limiting.

Frequently Asked Questions about commerce-api-gateway

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up GraphQL federation with Apollo Router?▼

Install Apollo Router via the curl script from router.apollo.dev and Rover CLI via npm. Define subgraphs in supergraph.yaml with federation_version =2.5.0, then run rover supergraph compose to build the supergraph schema and start the router with router.yaml.

How to build a REST BFF that aggregates multiple microservices?▼

Use Fastify to create composite endpoints that call upstream services in parallel with Promise.allSettled. Return graceful fallbacks for non-critical services like inventory or CMS, while failing the request only when the primary service (catalog) rejects.

Apollo Federation vs schema stitching for microservices?▼

Apollo Federation is the standard for composing GraphQL subgraphs because it enforces clear ownership with @key, @extends, and @external directives and supports schema registry checks in CI. Schema stitching with @graphql-tools/wrap is better suited for wrapping legacy REST APIs as virtual subgraphs.

How do I fix N+1 queries in a GraphQL gateway?▼

Use the DataLoader pattern in entity resolvers to batch multiple product ID lookups into a single bulk API call per service. Apollo Federation's @key directive combined with batch-resolving fetches all referenced entities in one request instead of one per item.

Why is my gateway auth token not reaching subgraphs?▼

Apollo Router does not forward headers to subgraphs by default. Configure headers.all propagation in router.yaml to forward the Authorization and x-customer-id headers so subgraphs can perform per-field authorization.

Can I use wildcard CORS origins on an authenticated gateway?▼

No, never use wildcard * CORS origins on an authenticated gateway. List your storefront domains explicitly in router.yaml, such as production and staging URLs, to prevent unauthorized cross-origin requests.