Protected Quick Tunnels: simple accountless authentication for your next dev project

Cloudflare has added optional email-based access controls to Quick Tunnels in cloudflared version 2026.9.3, allowing developers and coding agents to expose local services through temporary trycloudflare.com URLs while restricting access to specified email addresses or domains using the --allowed-mail flag. Visitors authenticate with a one-time PIN through Cloudflare Access, but authorization rules remain locally in cloudflared rather than being stored in a Cloudflare account, preserving Quick Tunnels’ account-free setup and keeping invite lists on the developer’s machine. Public tunnels remain unchanged when the flag is omitted, while protected tunnels end when the cloudflared process stops and require restarting to alter access rules. The feature also supports JSON output for agent workflows and is available through Wrangler for Workers users. Its architecture combines Cloudflare Access for identity verification with a stateless Workers-based broker that issues short-lived signed assertions, while cloudflared validates those assertions, enforces local rules, creates temporary sessions, and prevents authentication credentials from reaching the local application.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.