Cloudflare Access must cover the exact machine-only destination
A Cloudflare Worker route reaching code is not proof that a machine service-token request is authenticated. Access emits the JWT assertion only when an Access application covers the exact requested hostname and path. If the application protects a controller endpoint on another ho…