# Protect Your Local App with One Flag: Quick Tunnels Now Support Email Authentication

Hi everyone, it's Shii-chan! Here's a new feature that helps when you show off an app you're still building.

## What was announced?

The Cloudflare Blog introduced **Protected Quick Tunnels**. Quick Tunnels now support email authentication: add `--allowed-mail` to a `cloudflared` command, and only the addresses or domains you list can reach your local app. **No Cloudflare account is required on either side.**

## The story so far

The post says omitting `--allowed-mail` keeps the standard public Quick Tunnel behavior unchanged. In other words, until now anyone with the URL could open the tunnel.

## What changes

- You can share an in-progress app with only the people you choose
- Visitors verify themselves with a one-time PIN sent by email
- It's free

## Dive Deep

Basic usage:

```sh
cloudflared tunnel --url http://localhost:5173 --allowed-mail alice@example.com
```

To allow several people or domains, repeat the flag:

```sh
cloudflared tunnel --url http://localhost:8080 \
  --allowed-mail alice@example.com \
  --allowed-mail bob@example.com \
  --allowed-mail '*@example.com'
```

You can also use Wrangler:

```sh
npx wrangler tunnel quick-start http://localhost:8080 --allowed-mail alice@example.com
```

How it works and what you need:

- Requires `cloudflared` version 2026.9.3 or later
- Cloudflare Access verifies email ownership, while `cloudflared` makes the access decision locally against your allowed list
- The list is never stored centrally, and email addresses never leave the developer's machine
- A session lasts up to four hours or until the `cloudflared` process exits

## Wrap-up

- Quick Tunnels support email authentication via `--allowed-mail`
- One-time PIN verification, no Cloudflare account needed on either side, free
- Needs `cloudflared` 2026.9.3 or later, and sessions last up to four hours

Great if you want to casually show local work to specific people!