Cloudflare adds email-gated access to Quick Tunnels in cloudflared 2026.9.3
Cloudflare's cloudflared 2026.9.3 adds an --allowed-mail flag so Quick Tunnels admit only chosen emails or domains via a Cloudflare Access one-time PIN.
Before you start: versions, package names and storage identifiers change over time. Check the commands against the official documentation for your setup before running them, especially anything that creates, deletes or overwrites data.
Cloudflare has shipped a way to keep Quick Tunnels from being open to anyone with the link. Starting with cloudflared 2026.9.3, the connector accepts a new --allowed-mail flag that restricts a tunnel to the email addresses and domains you specify, according to the company’s announcement.
Quick Tunnels, launched in 2021, publish a local service at a random trycloudflare.com URL with a single command and no account, domain or cost. The trade-off has always been the same: whoever has the URL can open it.
How the flag works
Pass an address to the flag and only that person gets in:
cloudflared tunnel --url http://localhost:8080 --allowed-mail [email protected]
Cloudflare describes the flow this way: the visitor opens the URL, enters their email address, types the one-time PIN sent to their inbox, and reaches the app. Everyone else is stopped before a request reaches your machine. Cloudflare Access handles the PIN, and neither side needs a Cloudflare account.
To admit more people, repeat the flag or allow a whole domain with a wildcard such as '*@example.com'. Leave --allowed-mail out and public Quick Tunnels behave exactly as before. Changing the guest list means stopping cloudflared and starting a new tunnel, since access ends for everyone when the process exits.
Why Cloudflare built it now
Cloudflare says agents have driven adoption of Cloudflare Tunnel and Quick Tunnels to grow exponentially. Coding agents need a URL to show off what they built, MCP servers on a laptop need a public endpoint, and an agent running on a Mac mini at home needs to be reachable from a phone. Adding --output json turns each log line into a JSON object so an agent can pull the URL out without scraping text.
The company points to a September 18, 2026 Hacker News thread on the Quick Tunnels page that reached more than 800 points and 300 comments, including one commenter asking how long it would take before an agent exposed “one’s most sensitive, private and embarrassing information or insecure work-in-progress app.”
For a stable hostname or richer rules such as identity provider groups, Cloudflare directs users to Cloudflare Tunnel with Cloudflare Access instead.
Related reading
Sources
- Protected Quick Tunnels: simple accountless authentication for your next dev project — Cloudflare Blog
Some links on this page may be affiliate links. If you buy through them we may earn a commission at no extra cost to you. See our affiliate disclosure.
