you can protect it with Cloudflare Access & Service Tokens, then make the worker send those service tokens in the headers