Every public API is under constant, automated pressure. Credential-stuffing bots, scrapers and vulnerability scanners do not take days off, and a backend that exposes its internal services directly to the internet gives attackers a detailed map of exactly where to push. The architecture we now standardise for client platforms places a single, hardened API gateway between the outside world and everything behind it.

The gateway is the only public door. Frontend applications, mobile apps and third-party integrations all authenticate there — with signed tokens, scoped API keys, or both — while the underlying services communicate on a private network and accept traffic from nowhere else. This decoupling means a compromised or misbehaving client can be throttled, re-scoped or revoked at the gateway without touching the services behind it, and internal endpoints are never discoverable from the public internet.

Rate limiting is enforced per client, per endpoint and per behaviour pattern rather than as one blunt global number. A legitimate customer syncing their dashboard is unaffected, while a script attempting 400 login requests a minute is cut off within seconds. Combined with structured request logging at the gateway, this gives operations teams a single place to see abuse patterns and respond before they become incidents.

For human-facing forms and authentication flows, we pair the gateway with Cloudflare Turnstile — a privacy-respecting challenge that separates real visitors from bots without the friction and tracking of traditional CAPTCHAs. Turnstile verification happens before a request reaches the application at all, so credential-stuffing traffic is discarded at the edge and never consumes application resources.

None of this replaces secure code, patched servers or least-privilege access — it complements them. But in incident reviews, the pattern is consistent: platforms fronted by a gateway with enforced authentication, granular limits and bot filtering simply present a smaller, harder target. For any business exposing an API to the public internet, that layer is no longer optional architecture. It is the front wall.