Client Security

Hello. Congratulations on the course. I managed to evolve in terms of security.
But, I would like to understand how to allow access to client services only through the gateway service, as it is possible to make a direct query in the swaggy api without a token/authorization. Do you have any examples? 
Thanks again.