Zhivko Todorov
ALL CASE STUDIES

CASE 68 · RIVET · 2025

API GATEWAYCUSTOM DOMAINSIAM AUTHINTERNAL APIs

An internal API gateway that engineers prefer over service URLs.

An enterprise SaaS company had 40 internal services with a wall of internal load balancer URLs that nobody could remember. We built an internal API gateway with custom domain names, IAM auth, and a self-service registration flow.

INDUSTRY

Enterprise SaaS

DOMAIN

PLATFORM

DELIVERED

2025

STACK

AMAZON API GATEWAY (PRIVATE)·ROUTE 53 PRIVATE HOSTED ZONE·IAM AUTH·BACKSTAGE·CDK·CLOUDFRONT (FOR PUBLIC)

RESULTS

What changed, by the numbers.

INTERNAL URLS REMEMBERED

40

NICE NAMES, NOT IPs

API CONSUMER ONBOARDING

< 10m

SELF-SERVICE

AUTH STANDARDISED

100%

IAM SIGv4

DEPRECATED ENDPOINTS

TRACKED

METRICS ON USAGE

HOW IT WENT

The pre-state was a Confluence page titled "Internal Service Endpoints" that everyone bookmarked and nobody updated. Engineers copy-pasted ALB DNS names into their config. New hires were told "ask in #engineering for the URL."

We built a private API Gateway with custom domains under `api.internal.company.com/<service>`. Each service registered itself through a Backstage template that emitted a CDK change. IAM SigV4 auth replaced the four homegrown auth schemes that had accumulated. Usage metrics surfaced deprecated endpoints automatically.

Engineers adopted the new names voluntarily. The Confluence page got deleted in week eight. Self-service registration means a new service is reachable under a clean name within ten minutes of repo creation.

READY WHEN YOU ARE

Let's get your AWS bill (and architecture) in order.

The discovery call is free. You walk away with at least one concrete idea — even if we never work together.

Or email directly →