Cloudflare Adds Email-Based Access Controls to Quick Tunnels

Summary

Cloudflare adds an optional `--allowed-mail` flag to Quick Tunnels, letting developers restrict access through email verification without an account. The allowlist stays on the developer’s machine, and protected tunnels do not fall back to public access.

Key points

Starting with cloudflared 2026.9.3, developers can restrict Quick Tunnels to specified email addresses or domains using `--allowed-mail`; visitors verify control of an address with a one-time PIN.
Cloudflare Access verifies the email, while a stateless broker issues a short-lived signed assertion. cloudflared checks the assertion against rules held locally; Cloudflare does not receive the guest list.
A protected tunnel refuses to start if the service does not confirm its authentication mode, and it never falls back to public access.
After successful verification, cloudflared creates a local session lasting up to four hours, or less if the Access sign-in expires sooner.
cloudflared strips authentication credentials before forwarding requests to the local application, which does not need to implement its own login flow.
The latest Wrangler version can start protected Quick Tunnels and removes `--allowed-mail` values from debug logs.

Article Details

Event Type: Cloudflare introduced email-based access protection for accountless Quick Tunnels.
Impact: Starting with cloudflared 2026.9.3, developers can use --allowed-mail to restrict a Quick Tunnel to specified email addresses or domains. Visitors verify their email with a one-time PIN; cloudflared checks the allowlist locally, and requests that fail checks do not reach the developer’s service. The guest list remains on the developer’s machine, and the feature requires no Cloudflare account.

People

Alessandro FrigerioWorked on the engineering side of Protected Quick Tunnels, which Cloudflare says he helped deliver to production.Hugo VicenteWorked on the product side of Protected Quick Tunnels, which Cloudflare says he helped deliver to production.

Vendors

CloudflareThat command starts a Quick Tunnel. cloudflared, Cloudflare's lightweight connector, publishes your local service at a random trycloudflare.com URL. No account, no domain, no cost. Agents now use Quick Tunnels for the

Products

Cloudflare Accessand domains you choose. Visitors prove they own one of those addresses with a one-time PIN from Cloudflare Access. Nobody, on either side, needs a Cloudflare account.Cloudflare Meshat home from your own devices without any public URL and establish bidirectional connectivity, use Cloudflare Mesh.Cloudflare TunnelSince agents took off, Cloudflare Tunnel and Quick Tunnels adoption has grown exponentially. On September 18, 2026, a link to the Quick Tunnels page climbed to the top of Hacker News and gathered more than 800 points Cloudflaredcloudflared tunnel --url http://localhost:5173 Quick TunnelsWe launched Quick Tunnels in 2021 to give developers an easy way to share their latest service, application, or project running in their local development environment. A lot has changed since then, but the core use case WorkersIf you build on Workers, you can start the same kind of tunnel from the latest version of wrangler:WranglerStart a protected tunnel from Wrangler