An API gateway is the front door for backend services. It authenticates requests, enforces quotas, transforms payloads, and dispatches to the right service. Useful once you cross ~3 microservices. For a single-server PHP/MySQL law firm site, it is over-engineering.