Where we use it
- Public APIs
- Payment webhooks
- Mobile BFF layers
What we do with it
- Authenticated REST and webhook receivers
- Rate limits, CORS, and request validation
- File uploads and signed URLs
- Composition with Socket.IO on the same process or a sibling service
