What is an API gateway for, and why shouldn't it be mistaken for a security product?

Question

Accepted Answer

An API (Application Programming Interface) is an interface to a piece of software, and an API gateway publishes that interaction possibility outside the own company network, especially web interfaces that use the internet as a universal transport. It is a publication medium meant to create connectivity; its primary focus is not necessarily security.
Depending on its emphasis, an API gateway can also take over conversions, checks, transport encryption and authentication. The line between API gateways and data gateways has become fluid, and many vendors now sell their products as "business integration" rather than gateways.
The architectural point is the same as with data gateways: an API gateway exists to open access to internal software. Whatever security it adds is a feature to be verified, not its purpose.
Go deeper:

API management — Wikipedia — gateways as the publishing layer for APIs.
 Microsoft Learn — API gateways — what an API gateway does in an architecture: routing, aggregation, offloading.
 OWASP API Security Top 10 (2023) — the risks a published API brings, gateway or not.