from the test you can throw an error right away if the

Cypress.env('CF_SECRET')

is not set

thank you very much for your help! turns out I was setting headers wrong, it works now!