How do you handle WAF for APIs that have mobile app clients?

Hey everyone, new to this side of things and trying to wrap my head around something.

We're setting up a service with a public API that's used almost exclusively by our own mobile apps (iOS/Android). I get that WAF rules are great for blocking common web attacks, but a lot of them seem to assume a browser context. Things like blocking specific user-agents or certain query patterns might accidentally block our legitimate app traffic.

For those of you with similar setups, how do you configure AWS WAF to be secure without breaking the mobile app? Do you create allow-lists for your app's traffic somehow, or just avoid certain rules entirely? I'm especially curious about managing things like rate limiting when each user has the app installed.