It's pretty rare to have more then 1 client facing API even for large apps. Whether it's a monolith, an API gateway, Apollo federation or whatever.

What you do to authenticate between the BFF (for lack of a better name) and other services is a different matter.