Exactly, Cloud Functions can only handle one request at the time, if one instance gets 2 simultaneous request then another instance will be created, and you will be charged double. With Cloud Run you can handle up to 250 simultaneos request in a single instance, and it scales nice as well. You also has a free tier that can take more advantage of because of this capacity of handling multiple requests. Also I forgot to tell you: you should use GCP API Gateway service as a middleware between your frontend app and your backend (Cloud Run or Cloud Function, it doesn't matter) to protect against unauthenticated calls and to your backend's undefined paths calls. It also has a good free tier.
Exactly, Cloud Functions can only handle one request at the time, if one instance gets 2 simultaneous request then another instance will be created, and you will be charged double. With Cloud Run you can handle up to 250 simultaneos request in a single instance, and it scales nice as well. You also has a free tier that can take more advantage of because of this capacity of handling multiple requests. Also I forgot to tell you: you should use GCP API Gateway service as a middleware between your frontend app and your backend (Cloud Run or Cloud Function, it doesn't matter) to protect against unauthenticated calls and to your backend's undefined paths calls. It also has a good free tier.
That sounds good. So I'm currently using App Check with Recaptcha 3 and protecting each individual call, but this sounds like a good way to go.