Loading post…
CloudflareAlessandro FrigerioAnnouncement
Protected Quick Tunnels: simple accountless authentication for your next dev project
Summary
Cloudflare’s Quick Tunnels now support email-based access control via the –allowed-mail flag, requiring no account on either side. The feature addresses the risk of exposing sensitive work, especially as AI coding agents increasingly use tunnels to share previews. Cloudflare Access verifies the visitor’s email with a one-time PIN, while cloudflared on the developer’s machine authorizes the request against a local rule list. The guest list never leaves the developer’s machine, and the tunnel remains accountless and free. The feature was built and shipped by two interns, Hugo Vicente and Alessandro Frigerio.
Context
Quick Tunnels, launched in 2021, let developers share local services via a random trycloudflare.com URL with a single command, no account required. The lack of access control meant anyone with the link could reach the service. With the rise of AI coding agents that automatically create tunnels, the risk of exposing sensitive work increased, motivating the addition of email-based authentication.
Approach / What changed
Add the –allowed-mail flag to the cloudflared tunnel command, specifying email addresses or domains. Cloudflare Access verifies the visitor’s email via a one-time PIN, and cloudflared on the developer’s machine authorizes the request against the local rule list. The guest list never leaves the developer’s machine.
Takeaways
Add –allowed-mail to the cloudflared tunnel command to restrict access to specific email addresses or domains; the guest list is stored only on your machine.
Cloudflare Access handles email verification with a one-time PIN, but authorization is performed locally by cloudflared, keeping the guest list private.
Protected tunnels are free and require no Cloudflare account; the feature is designed for one-command use by both humans and AI coding agents.
FAQ
Does Cloudflare see my guest list?
No. The guest list (email addresses and domains) is stored only in cloudflared's memory on your machine. Cloudflare Access verifies the visitor's email, but the authorization decision is made locally by cloudflared, so the list never leaves your machine.
How do I change who can access a running tunnel?
Stop cloudflared and start a new tunnel with the updated --allowed-mail flags. There is no way to modify the rules of a running tunnel; access ends for everyone when the process exits.
Does email protection cost extra?
No. The feature is free, like Quick Tunnels themselves. You only need to install or update cloudflared and add the --allowed-mail flag to your command.
Source and freshness
- Source
- blog.cloudflare.com
- Published
- Added to Yomu
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.