How to secure my API-GW endpoint?

Hello folks,
I am setting up a Global LB using a server-less NEG for API-GW and I followed this document: here

With a bit of hassle, I am able to do the above and it works well. Now my concern is how can I ensure that only the requests coming from CF are served and not the which hit LB-static IP or API-GW endpoint.
CloudFlare Origin Certificate ensures that LB-static IP is secured but I am still not getting a solution for making api-gw secure. I did some research for the potential solutions but still not convinced to use any.

1. Not in favour of allowing certain ranges of CF only as these keep changing and are hard to manage.

2. Custom header would have been awesome but the issue is that api-gw spec can only check the presence of the header and not the secret value I put.

3. Well backend service validation is bad cause the request is already at the core.

Now tools like Traefik/HAProxy need to be deployed in a CloudRun which makes it a SPOF, hence that too doesn't work.

Can anyone please guide as to what can be my best approach here?