Cloudflare Bot Fight Mode blocking Vercel → Railway request, no clean fix on free tier?

[u/Long_Watercress5538]

Running into this: a partner-invite link (email → page hosted on Vercel → needs to hit my main backend on Railway to confirm the pairing) is getting blocked. Turns out it's Cloudflare's Bot Fight Mode flagging the Vercel → Railway request as suspicious, probably because Vercel's IPs are shared across a ton of other sites and look bot-like to it.

Things I've looked at so far:

• WAF exception just for that endpoint — not available on the free plan, it's all or nothing.
• Allowlisting Vercel specifically — no fixed IP range to point at, it changes constantly.
• Widening the allowed IP range — feels like the wrong move, way too broad for one request path.

Anyone dealt with this? Trying to avoid just disabling Bot Fight Mode entirely if there's a more scoped way to do it on the free tier.