Cloudflare introduced Quick Tunnels in 2021 as a frictionless way for developers to expose local services to the internet. The tool has gained renewed momentum as AI agents increasingly use it to share generated code and run services from edge devices. Now the platform is adding email-based access controls to address security concerns around unprotected tunnel links.
Beginning with cloudflared 2026.9.3, developers can restrict tunnel access by passing the --allowed-mail flag when launching a tunnel. Visitors attempting to reach the URL land on a Cloudflare Access sign-in page, where they enter their email address and verify ownership by entering a one-time PIN. Only email addresses matching the developer's allowlist gain access to the service running on their machine.
The implementation requires no account creation, domain configuration, or dashboard interaction. A single command like cloudflared tunnel --url http://localhost:8080 --allowed-mail alice@example.com is sufficient. Multiple addresses can be specified by repeating the flag, and entire domains can be allowed using wildcard syntax such as '*@example.com'.
Why agents drove adoption of Quick Tunnels
AI agents writing code need a way to demonstrate results to users. Agents running on local hardware require public endpoints to be callable from remote devices. Model Context Protocol servers need URLs before hosted assistants can invoke them. Quick Tunnels provide this capability through a single command that agents can execute independently, with no signup forms to block execution.
Adoption has accelerated sharply. On September 18, 2026, a link to the Quick Tunnels documentation reached the top of Hacker News, accumulating over 800 points and 300 comments. The discussion thread documented numerous agent workflows, including instances where AI systems discovered and deployed Quick Tunnels autonomously. One commenter noted they were "insanely helpful when doing agentic work on the go."
However, the same thread surfaced a critical concern: without access controls, agents could inadvertently expose sensitive information or unfinished applications to the public internet. The email protection feature directly addresses this risk.
How the architecture separates authentication and authorization
The design distinguishes between two functions: authentication (verifying a visitor's email ownership) and authorization (deciding whether that visitor should access the service). Cloudflare Access handles authentication by sending and validating one-time PINs. Authorization decisions remain on the developer's machine, where cloudflared compares the verified email against the local allowlist.
This separation ensures the guest list never leaves the developer's machine. Cloudflare learns only that a tunnel requires email authentication; it never sees which addresses are permitted. The design satisfies four core requirements: keeping Quick Tunnels accountless, maintaining the request path for public tunnels, avoiding central policy lookups after sign-in, and protecting email address privacy.
A stateless authentication broker running on Cloudflare Workers converts verified identity into a short-lived, signed assertion. cloudflared validates this assertion and enforces authorization rules in memory against the developer's configuration. Sessions last up to four hours or until the tunnel process stops.
Request flow through a protected tunnel
- cloudflared detects a request without a session and redirects to login.trycloudflare.com with a single-use state valid for 10 minutes.
- Cloudflare Access sends a one-time PIN to the visitor's email and verifies it.
- The broker returns a short-lived, signed assertion bound to the tunnel hostname and state, delivered via form POST to avoid URL exposure.
- cloudflared verifies the assertion, consumes the state, and matches the email against the allowlist. On success, a local session is created; otherwise, a generic rejection response is returned.
- Subsequent requests use the session cookie, which contains only a random value and expiry time, for up to four hours or until the tunnel stops.
The session cookie reveals nothing about visitor identity. cloudflared strips authentication credentials before forwarding requests to the local service, so applications never see login details or implement their own authentication. If any verification step fails, the request never reaches the local machine.
Integration with agents and developer tools
Developers can instruct AI agents to always include the --allowed-mail flag by adding a line to files like AGENTS.md. cloudflared logs whether email authentication is active and displays rule counts without exposing email addresses, allowing developers to verify agent behavior.
The latest version of Wrangler, Cloudflare's CLI tool for Workers, supports protected Quick Tunnels through the command npx wrangler tunnel quick-start http://localhost:8080 --allowed-mail alice@example.com. Wrangler handles repeated flags, comma-separated values, and wildcard domains while removing --allowed-mail values from debug logs.
Alternatives for advanced use cases
For scenarios requiring stable hostnames or richer authorization rules such as identity provider groups, Cloudflare recommends using Cloudflare Tunnel with Cloudflare Access. For accessing agents at home from personal devices without exposing a public URL, Cloudflare Mesh enables bidirectional connectivity.
Availability and implementation
Email protection for Quick Tunnels is free, matching the pricing of Quick Tunnels themselves. The feature shipped in cloudflared 2026.9.3, developed by two interns, Hugo Vicente on product and Alessandro Frigerio on engineering, who took the project from requirements through production release.
Developers can begin using the feature immediately by installing or updating cloudflared and adding the --allowed-mail flag to their tunnel command. Complete setup details, matching rules, and usage limits are available in the Quick Tunnels documentation.