Multidomain and wildcards in cloudfare access

Zero Trust Access
1

What is the name of the domain?

examplecom

What is the issue you’re encountering

When making requests from my webapp (https://app.dev.examplecom) to my api (https://api.dev.examplecom), the API requests are being redirected to the Cloudflare Access SSO login page. This happens despite configuring Cloudflare Access with a wildcard domain (*.dev.examplecom) to ensure shared authentication across subdomains. Im using Azure AD SSO. When I go to https://app.dev.examplecom im redirected to Cloudflare Acess login page and the option to login with Azure AD SSO, It works fine and creates a CF_AUTHORIZATION cookie for domain app.dev.examplecom then any calls from app.dev.examplecom to api.dev.examplecom are redirected to the Cloudflare access login page (thats the response I can see in chrome console).

3

I have tried adding both domains in the same access application separately without wildcards. app.example and api.example. Now i can see that upon successful login in app.example it generates a CF_AUTHORIZATION cookie for app.dev.example and when the app makes a request to the api it generates another CF_AUTHORIZATION cookie for api.dev.example, however still get a 302 redirect to Cloudflare access login page.