My understanding is that there is some sort of rate limiting around PATs per Apple ID (that’s why they require you to be signed in). Also if you want to scale to millions per day you don’t want to have to use headless browsers.

Cloudflare explicitly says that PAT is one signal in its challenge decisions, not an automatic bypass.

Best is still the apple privacy proxy.

[flagged]