When to Use an API Gateway vs Service Mesh

They solve different control problems

API gateways are usually the right answer for north-south traffic, external exposure, authentication, developer access, and API policy. Service meshes are usually the right answer for east-west traffic, service identity, resilience, and internal traffic shaping.

• Use an API gateway for exposure, auth, and consumer-facing policy
• Use a service mesh for internal service-to-service control
• Use both when edge and internal traffic need different layers of control

Where teams get this wrong

The common mistake is forcing one layer to own problems it was not designed for. Teams should start from traffic direction, policy needs, and operational ownership instead of assuming one control plane should handle everything.