What are the primary methods to prevent DDoS attacks on an API Gateway?

Preventing DDoS attacks on an API Gateway involves a multi-layered approach. Key methods include rate limiting (throttling requests per IP, user, or API key), IP blacklisting/whitelisting, request validation (checking for malformed requests or unexpected payloads), geographical blocking, and utilizing Web Application Firewalls (WAFs) with DDoS mitigation capabilities. Implementing connection limiting and timeouts can also help prevent resource exhaustion.