Cloudflare blocks automated fetch requests by default

Cloudflare’s Bot Fight Mode treats non-browser user agents as bots and returns 403. To allow legitimate automated access, disable Bot Fight Mode in the Cloudflare dashboard under Security → Bots, or add a bypass rule for trusted IPs.