Not every API response needs a fresh origin hop. Public product, content and configuration GETs are often identical. Cache those. Never cache the ones that change with Authorization.
Mark the safe GETs
Catalogue, published CMS content, feature flags that are global, and OpenAPI docs are typical. Set a TTL that matches how wrong a stale answer can be, plus purge from the publish pipeline.
Bypass the rest
POST, PATCH, PUT, DELETE, and any GET that varies on Authorization or cookies. GraphQL POSTs usually bypass unless you have persisted public GET queries you fully control.
Shield and short TTLs
APIs with 15-60 second TTLs create regular miss storms. Origin Shield is how a small API cluster survives that pattern.
Tokens for private GETs
If a GET is cacheable for a cohort but not the world, token authentication can gate the cached object. Application auth still owns entitlements.