Hey @Mike_Cross and @Duke I did a little more digging and found this: Cloudflare IM NOT A ROBOT blocking API?!? - #7 by Jackie_Bow
I noticed I was getting served a website response as well, so I’m assuming it is the same as this issue.
Turns out Patreon added a security feature to serve a robot check CAPTCHA to any request without the User-Agent header as it’s a signal that the request is coming from malware.
Works in Postman because Postman automatically generates the User-Agent header.
I searched the entire API documentation for the word “User-Agent” but nothing return. This should really be included in the docs!
I haven’t tested yet but I believe any value for the header should work. Something like “node” or “Cloudflare-worker” is probably fine but again need to test!