No Cloudflare Access app here.
Protected purely by API Shield JWT validation on the WAF.
If you can see this directly without a valid CF_Authorization JWT, the WAF rule is not working.