Protect Your Local App with One Flag: Quick Tunnels Now Support Email Authentication

Hi everyone, it's Shii-chan! Here's a new feature that helps when you show off an app you're still building.

Cloudflare Blog blog.cloudflare.com

What was announced?

The Cloudflare Blog introduced Protected Quick Tunnels. Quick Tunnels now support email authentication: add --allowed-mail to a cloudflared command, and only the addresses or domains you list can reach your local app. No Cloudflare account is required on either side.

The story so far

The post says omitting --allowed-mail keeps the standard public Quick Tunnel behavior unchanged. In other words, until now anyone with the URL could open the tunnel.

What changes

• You can share an in-progress app with only the people you choose
• Visitors verify themselves with a one-time PIN sent by email
• It's free

Dive Deep

Basic usage:

cloudflared tunnel --url http://localhost:5173 --allowed-mail alice@example.com

To allow several people or domains, repeat the flag:

cloudflared tunnel --url http://localhost:8080 \
  --allowed-mail alice@example.com \
  --allowed-mail bob@example.com \
  --allowed-mail '*@example.com'

You can also use Wrangler:

npx wrangler tunnel quick-start http://localhost:8080 --allowed-mail alice@example.com

How it works and what you need:

• Requires cloudflared version 2026.9.3 or later
• Cloudflare Access verifies email ownership, while cloudflared makes the access decision locally against your allowed list
• The list is never stored centrally, and email addresses never leave the developer's machine
• A session lasts up to four hours or until the cloudflared process exits

Wrap-up

• Quick Tunnels support email authentication via --allowed-mail
• One-time PIN verification, no Cloudflare account needed on either side, free
• Needs cloudflared 2026.9.3 or later, and sessions last up to four hours

Great if you want to casually show local work to specific people!