setting the request headers works the same way. Are you sure you have the

Cypress.env('CF_SECRET')

? How do you pass it to the test runner? Read https://glebbahmutov.com/blog/keep-passwords-secret-in-e2e-tests/