Faced a similar issue while I was trying to programmatically interact with a website that I'll not mention. Surprisingly the website had a protection for which

Faced a similar issue while I was trying to programmatically interact with a website that I'll not mention. Surprisingly the website had a protection for which I was able to use their API via the browser, but not from cURL or Go. I was puzzled at first, then I understood what was going on. Basically what's being described in this article. Cloudflare was adding this "protection" against "unauthorized TLS fingerprints", and of course the Go HTTP / TLS client and cURL weren't on that list. To work around the issue (in Go), I simply used a customized version of this: https://github.com/Danny-Dasilva/CycleTLS https://github.com/Danny-Dasilva/CycleTLS