Best practices to secure rest api with gateway and spring security OAuth

Question

I would like to ask what are the best practices to secure application with [following architecture][1] https://i.stack.imgur.com/pTokw.png

Currently it is works