I self-host Joplin Server behind Cloudflare Tunnel, protected by Cloudflare Access. Access supports two ways to authenticate a request at the edge: an interactive browser SSO challenge, or a non_identity policy that admits any request carrying a valid
CF-Access-Client-Id / CF-Access-Client-Secret header pair (a "service token" — Cloudflare's mechanism for non-browser clients like CLIs and sync daemons).
The desktop/mobile Joplin client can't use either: it isn't a browser, so it can't complete the interactive challenge, and its Joplin Server sync target has no option anywhere in Advanced Sync Settings to attach custom HTTP headers to outgoing requests.
As a result, Joplin Server is the one sync target I have to leave completely outside Cloudflare Access, relying solely on its own email+password login — a weaker posture than every other self-hosted service I run behind the same tunnel.
I would like there to be a "Custom sync headers" option to the Joplin Server sync target in Advanced Sync Settings — a simple list of header name/value pairs (or a raw Header: value per line) that gets attached to every request the sync client makes to the sync target,
including the initial API/ping check. This is exactly the mechanism git (http..extraheader) and Obsidian LiveSync (its own "Custom headers" field) already support, and it's what makes it possible to put a service-token Access policy in front of those clients today.