Cloudflare Access must cover the exact machine-only destination

A Cloudflare Worker route reaching code is not proof that a machine service-token request is authenticated. Access emits the JWT assertion only when an Access application covers the exact requested hostname and path. If the application protects a controller endpoint on another host, identical service-token headers can still reach the Worker without an assertion and correctly fail. Add the machine-only destination to the reviewed Access application and policy before accepting route evidence or opening admission. This does not replace origin pinning, redirect rejection, or denial tests.

Applies when: A Worker authenticates headless callers with Cloudflare Access across multiple hostnames or paths. Keywords: Cloudflare Access Worker service token JWT destination hostname path route proof