For Workers & Pages, what is the name of the domain?
workers.dev (specific hostname withheld for privacy; no custom domain)
What is the error number?
1010
What is the error message?
HTTP 403; plain-text response: error code: 1010
What is the issue or error you’re encountering
On a Worker we own, a GET-only API is protected by Cloudflare Access Service Auth and application authentication. The same valid credentials return HTTP 200 with Node fetch but HTTP 403 / error 1010 with Python urllib. What supported, scoped configuration permits this legitimate service client on workers.dev while retaining both authentication boundaries?
What steps have you taken to resolve the issue?
Confirmed that the saved application credential works with Node fetch. Inspected the Worker Access tab: the hostname has an existing Service Auth policy. The Worker has no custom domain. Could not find a scoped Browser Integrity Check control in the Worker settings. An unauthenticated Python request also receives 1010. No security controls were disabled, and no browser impersonation was attempted. We want a supported solution without a global security disable or a paid upgrade.
What are the steps to reproduce the issue?
- Use an existing workers.dev Worker with a GET /api/cases endpoint protected by Access Service Auth plus an application owner-token header.
- Send valid CF-Access-Client-Id, CF-Access-Client-Secret and x-team-chappy-auth headers with Node fetch: HTTP 200.
- Send the same headers to the same GET endpoint using Python 3.12 urllib.request, with redirects disabled: HTTP 403, plain-text error code: 1010.
Is there a supported scoped control for this on workers.dev? If so, please explain the configuration and rollback procedure. Hostname, credentials, account identifiers and business data are intentionally omitted.