Authenticated origin pulls is a setting in which the origin server accepts connections only from a content delivery network (CDN) or reverse proxy that presents a valid client certificate. The origin checks that certificate during the TLS connection, so requests that did not come through the proxy are rejected. The purpose is to stop people from reaching the origin directly and bypassing the protections applied at the proxy, such as a web application firewall.
The strength of the setting depends on how it is configured. Some implementations offer a certificate shared across many of the provider's customers, which shows only that traffic came through that provider, not through your account. A certificate specific to your account or domain gives a stronger guarantee. Check your provider's documentation for which options exist and how they differ.
Authenticated origin pulls address one specific problem, which is direct access to the origin. They do not fix vulnerabilities in the application, and they do not help if the proxy itself is configured to pass malicious requests through. They also depend on the origin being set up to require the certificate and to reject connections without it; enabling the option at the CDN alone is not enough.
To use it effectively, enable certificate checking at the origin web server, confirm that requests without the certificate are refused, and keep patching the software behind it. Combine it with other measures, such as firewall rules for the origin, rather than relying on it alone.