I've played with Kong a tiny bit out of curiosity in the past. It works and it's built on battle tested nginx. The open source community is active and there are many plugins for basically everything.
Rate limiting and throttling are supported out of the box.
Keep in mind that if you put all your APIs behind a gateway you need it to not become a single point of failure, so you might have to cluster at least two instances of the API gateway.
The great thing about the API gateway "pattern" is that you can work and evolve APIs in the backend keeping the same interface for the clients if you need to, or for example make it so that all APIs have the same authentication system and so on.
I've played with Kong a tiny bit out of curiosity in the past. It works and it's built on battle tested nginx. The open source community is active and there are many plugins for basically everything.
Rate limiting and throttling are supported out of the box.
Keep in mind that if you put all your APIs behind a gateway you need it to not become a single point of failure, so you might have to cluster at least two instances of the API gateway.
The great thing about the API gateway "pattern" is that you can work and evolve APIs in the backend keeping the same interface for the clients if you need to, or for example make it so that all APIs have the same authentication system and so on.
Kong is a great recommendation, It's the most straightforward of the choices above and the community is very much alive.
I should mention thought that it's a bit "crippleware", features you might need like advanced tranformations and OAUTH requires an enterprise license.