Phase: 3 — L7 Networking + WAF + API Security Goal: Build the authentication and authorization layer for your API gateway. Cover API keys, HMAC request signing, JWT-like tokens, token bucket rate limiting, input validation, PII scrubbing, and CORS — the complete API security surface.
Background in this wiki: HTTPS guide Ch 12 (authentication, cookies, CORS) and Ch 21 (rate limiting by identity, idempotency keys); OSI guide, Layer 3 on why IP addresses aren't identities. Security in Depth: Chapter 24 (token exchange, with a Go JWT lab), Chapter 25 (ReBAC, with a Go lab), and Part 6A (API security).