We currently have a semi-microservice architecture:

• API (PHP)
• Frontend website (React / Node)
• Backend management website (React / Node)
• Backend organisation website (React / Node)

We would like to start writing some other backend services in Node that add new endpoint to our existing API. Our existing API manages users and authentication through JWTs.

Whats the best approach to manage user authentication across services?

Should we split out our auth and create an API gateway?