Designing a unified API gateway for diverse microservices: federation or composition?

We're currently refactoring a large monolithic application into a microservice architecture. One challenge we're anticipating is how to expose these disparate services through a single, coherent API for external clients. We've considered both an API gateway that federates requests to individual service APIs (e.g., using GraphQL federation) and one that composes responses from multiple services (e.g., a BFF pattern or a service orchestrator). Each approach seems to have its own set of trade-offs regarding development complexity, performance, and maintainability. What are people's experiences with these patterns in a microservice context, especially concerning API versioning and handling cross-cutting concerns like authentication/authorization?