Api Gateway can be used to apply authentication and authorization. However this is not always recommended. If the backend services not only called from gateway this will cause a security breach.

https://www.linkedin.com/pulse/do-you-absolutely-need-microservice-api-gateway-its-trap-love-hasija/

Client Can't Manage Communications

The client applications can try to handle multiple calls to microservice endpoints,

not manageable when it comes to communicates with different protocols like http,

GraphQL, gRPC and WebSocket.

▪ Complex Client Code

Cause to lots of requests to the backend services, create possible chatty

communications. Increases latency and complexity on the UI side. Becomes

complex client code.

▪ Strong Coupling

Creates coupling between the client and the backend. The client needs to know

how the specific microservices are decomposed. Increase the coupling between

client and services and also makes it harder to maintain the client.

▪ Cross-cutting Concerns

Authentication, Authorization, Rate Limiting, SSL certifications, Logging,

Monitoring, Load Balancing and Circuit Breaker. Implementing all these crosscutting concerns for every microservice is not a good solution.

https://www.linkedin.com/pulse/key-reasons-using-api-gateway-microservices-architecture-chad-ng/