I think you guys need to need to do this:

Create Page Rules in your Cloudflare dashboard:

Go to Rules > Page Rules

Add a rule for your API endpoints:

URL pattern: yourdomain.com/api/*

Set "Security Level" to "Essentially Off"

Toggle "Browser Integrity Check" to Off

Add another rule for protected pages:

URL pattern: yourdomain.com/page/*

Set "Security Level" to "High" or "I'm Under Attack"

Enable "Browser Integrity Check"

Configure Firewall Rules (optional for more control):

Go to Security > WAF

Create a rule that bypasses security for API endpoints

Rule name: "Allow API Access"

Expression: (http.request.uri.path contains "/api/")

Action: "Bypass"

Set default protection level:

Go to Overview > Security

Set your default Security Level to Medium or High

Adjust Bot Fight Mode settings in Security > Bots if needed

This configuration will allow direct access to your API endpoints while forcing browser verification