Also, for anyone who only has an old global API key lying around instead of the more recent tokens, you can set: -H "X-Auth-Email: $EMAIL_ADDRESS" -H "X-Auth

Also, for anyone who only has an old global API key lying around instead of the more recent tokens, you can set: -H "X-Auth-Email: $EMAIL_ADDRESS" -H "X-Auth-Key: $API_KEY" instead of the Bearer token header. Edit: and in case you're like me and thought it would be clever to block all non-Cloudflare traffic hitting your origin... remember to disable that.