Assuming this is an API and not a website, my approach would be (other than just paying cloudflare to handle it).

Application servers that aren't listed on DNS and their IPs kept secret. A _lot_ of proxy servers that take requests, check the auth, and forward the valid requests to the application servers. For invalid requests, just let them time out.

If checking the auth is expensive enough to cause problems, require some proof-of-work in the request too, and only check the auth if the PoW is there.

In other words, keep all the DDOS traffic off the application servers. Have sacrificial proxies. Make it cheap to handle the DDOS traffic and expensive to generate the DDOS traffic. And then just process the traffic. Spread the proxies across multiple cloud providers if you need to - but ideally ones with free ingress.