API gateways play a critical role in securing public-facing APIs by acting as a proxy between clients and backend microservices, aggregating responses, and eliminating unnecessary requests. To increase security, API gateways can implement policy enforcement, traffic overload protection, circuit breakers, decoupling of backend services from front-end applications, HTTPS encryption, request validation, logging, rate-limiting, web application firewalls, and designating separate API gateways for different use cases. By following these best practices, organizations can minimize the risk of successful attacks on endpoints and data in transit, mitigating common API threats such as SQL injection, cross-site scripting, and denial of service attacks.