Is your custom route displayed on strapi’s admin permission list page? You need to set public or authenticated permission on this page.