Should I use one gateway for internal, partner, and public APIs?

Usually no—not as a single shared gateway for all three.
A better pattern is:

• Public APIs: one gateway at the edge, optimized for internet traffic, auth, throttling, WAF/rate limits, versioning, etc.
• Partner APIs: often a separate gateway or at least a separate gateway instance / tenant / logical partition with stricter access control, quotas, and contract management.
• Internal APIs: usually keep them on an internal gateway or service-to-service layer, focused on zero-trust, internal auth, routing, observability, and lower-latency/private networking.

Why not one gateway for everything?

Because the requirements differ a lot:

• Security boundaries: public traffic is highest risk; internal traffic should not share the same exposure surface.
• Policy differences: partner APIs often need per-partner quotas, keys, SLAs, and isolation.
• Blast radius: one misconfiguration or traffic spike can affect all API types.
• Operational complexity: different auth schemes, logging, and lifecycle processes can get messy in one shared setup.
• Network placement: internal APIs usually shouldn’t traverse an internet-facing gateway.

When one gateway can be okay

A single platform can work if it supports strong logical isolation, for example:

• separate listeners / domains
• separate tenants / workspaces
• separate route namespaces
• distinct security policies
• separate rate limits and quotas
• independent deployments for public vs internal traffic

In that case, it’s really one gateway product/platform, but not necessarily one shared runtime/instance.

Practical recommendation

For most organizations:

• Use one gateway platform
• Deploy it in multiple tiers:
  • public edge gateway
  • partner gateway
  • internal gateway

This gives you reuse of tooling while keeping security and operational isolation.

If you want, I can also give you a decision matrix for when to split vs combine, or a reference architecture for public/partner/internal API gateways.