An API Gateway acts as a reverse proxy to accept all API calls, aggregate various services, and return the appropriate result.

Key features:
1. **Request Handling:**
   - Authentication
   - SSL termination
   - Rate limiting

2. **Integration:**
   - Service discovery
   - Request routing
   - Response transformation

Example of Kong API Gateway configuration:
```yaml
services:
  - name: user-service
    url: http://user-service:8000
    routes:
      - name: user-route
        paths:
          - /users
    plugins:
      - name: rate-limiting
        config:
          minute: 5
          policy: local
```

Key benefits include:

1. **Security:**
   - Centralized authentication
   - Authorization
   - SSL/TLS termination

2. **Performance:**
   - Caching
   - Request/Response transformation
   - Load balancing

3. **Monitoring:**
   - Analytics
   - Logging
   - Rate limiting

API Security involves protecting APIs from threats and vulnerabilities while ensuring they remain accessible to authorized users.

Key security measures:
1. **Authentication:**
   - API keys
   - OAuth 2.0
   - JWT tokens

2. **Authorization:**
   - Role-based access control
   - Scope-based access
   - Resource-level permissions

Example of OAuth2 configuration:
```yaml
security:
  oauth2:
    client:
      clientId: ${CLIENT_ID}
      clientSecret: ${CLIENT_SECRET}
    resource:
      tokenInfoUri: https://api.auth.com/oauth/check_token
```

Rate Limiting is a technique used to control the rate at which requests are processed or transmitted.

Key concepts:
1. **Token Bucket Algorithm:**
   - Fixed number of tokens
   - Tokens are replenished at a fixed rate
   - Tokens are consumed at a variable rate

2. **Leaky Bucket Algorithm:**
   - Fixed size bucket
   - Water leaks out at a fixed rate
   - Water is added at a variable rate

Example of Nginx Rate Limiting configuration:
```nginx
http {
    limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;

    server {
        location / {
            limit_req burst=5 nodelay;
        }
    }
}
```

API Documentation is a set of documents that describe how to use an API. It includes:

1. **API Reference:**
   - Detailed description of each API endpoint
   - Request and response formats
   - Example requests and responses

2. **API Usage Examples:**
   - Code samples
   - API client libraries
   - API testing tools

Example of Swagger API Documentation:
```yaml
swagger: '2.0'
info:
  title: User Service API
  version: 1.0.0
paths:
  /users:
    get:
      summary: List users
      responses:
        '200':
          description: List of users
    post:
      summary: Create user
      responses:
        '201':
          description: User created
```