I don’t use it currently (except on one of the front ends we use as a test) but I believe the easiest way would be to use nginx to separate the paths you want to pass traffic to, so it doesnt apply to api traffic etc, only the ui. I use traefik for piefed so I don’t know how it integrates in there yet, but I know a few people have got it working for lemmy by using the nginx paths.

There is also go-away as an alternative option.

I have made extensive use of cloudflares challenges too