Cloudflare operates as a content delivery network and distributed DNS (domain name server). Its services protect website owners from peak loads, comment spam attacks and DDos (distributed denial of service) attacks.
@arvidkahl@Cloudflare The API is protected by CF?
Free account? LB at CF in use?
You could whitelist your services additionally to auth, e.g. with a special header.