Exposing every microservice directly to external clients (a mobile app, a browser) has real problems: the client needs to know about, authenticate against, and handle the availability of every individual service, and a genuinely client-facing concern like rate limiting or authentication ends up duplicated across every service instead of handled once.
An API gateway sits in front of all the services as a single entry point — it can handle authentication, rate limiting, request routing (mapping one public URL scheme to whichever internal services actually serve it), and even response aggregation (combining calls to several backend services into one response for the client), so individual services don't each need to reimplement all of that.
A related, more targeted pattern is Backend-for-Frontend (BFF) — rather than one generic gateway serving every client, each distinct type of client (a mobile app, a web app, a third-party public API) gets its own tailored backend layer, shaped around exactly what that client needs, rather than forcing a mobile app to make five separate calls that a purpose-built mobile BFF could satisfy in one.