- Not sure how to deal with authentication ( if i use graphql for that or some API gateway level auth )

prisma layer has its own authentication (if enabled) how you implement authentication for your application layer is pretty much up to you ... you can use template (when prisma init) which contains auth to give you some idea

i tend not to use Prisma or GraphQL for authentication, i see benefits in having it bundled with other features like rate limiting and routing different APIs