Or, you know, use client certificates so the bots can’t hit you.

Those can leak / be stolen of course, but a bunch of my clients php apis survived as without a cert they’re told to fuck right off.

It does make their client onboarding a bit harder but it’s a trade off which seems to have been the right one.