Verifying the source of a request in a microservice architecture

One approach would be expose a public service via an API gateway. The application can call the public service and the public service can invoke private microservices. However, the application cannot invoke private microservices.