API Gateway
A single entry point in front of a set of services that handles authentication, rate limiting, routing and protocol translation.
The argument for it is that a dozen services should not each implement token validation, rate limiting, request logging and CORS — those are policies, they should be enforced once, and they should be enforced consistently.
The argument against any specific implementation is that gateways attract business logic. Once request transformation becomes request enrichment, and enrichment becomes orchestration, the gateway is a distributed monolith that every team must queue to change.
The line worth holding: a gateway does authentication, authorisation at a coarse grain, rate limiting, routing, protocol translation and observability. It does not do business rules, aggregation across services or data enrichment. Those belong to a BFF or a service.