Cloudflare Access and your admin credentials are both required in production.
First time? Run POST /api/admin/bootstrap after setting ADMIN_BOOTSTRAP_EMAIL and ADMIN_BOOTSTRAP_PASSWORD in .dev.vars