Protected Quick Tunnels: simple accountless authentication for your next dev project

Quick Tunnels allow developers to share local services from their development environment via a public URL without needing accounts, domains, or incurring costs. The process involves a command that publishes the local service to a Cloudflare URL. A security feature was introduced in 2026.9.3 allowing users to restrict access by specifying allowed email addresses or domains using the `--allowed-mail` flag. Visitors accessing the link must prove ownership of one of these specified addresses with a one-time PIN from Cloudflare Access, which requires no separate Cloudflare account for either party.
This mechanism was developed to provide a direct path from a local port to a public URL for coding agents and other workflows. Agents use Quick Tunnels to expose results without requiring complex setup. The core design resolved the challenge of policy management without needing user accounts by having the authentication reside with the visitor's email and authorization logic residing on the developer's machine via cloudflared.

* Quick Tunnels were launched in 2021 to share local services.
* A command `cloudflared tunnel --url http://localhost:5173` starts a Quick Tunnel.
* The command publishes the local service at a random trycloudflare.com URL.
* Starting with cloudflared 2026.9.3, the `--allowed-mail` flag can restrict access to specific email addresses or domains.
* Access requires visitors to prove ownership of an address via a one-time PIN from Cloudflare Access.
* Quick Tunnels facilitate workflows for agents that need public endpoints without signup forms.
* A process involves sending a code to an email address, which the visitor must provide to gain access.
* Protected tunnels require adding `--allowed-mail` flags and are enforced by cloudflared checking rules locally.
* The system separates authentication (proving identity via email) from authorization (access control), with authorization remaining on the developer's machine.

The narrative addresses a critical tension between providing frictionless, agent-centric utility and maintaining robust security and privacy for sensitive local work. The core innovation lies in decentralizing access control: achieving secure authorization without requiring a centralized account structure. This shifts the burden of policy management from a central authority to the endpoint developer's machine, which is a significant departure from traditional centralized identity systems.
The implication is that features designed for speed—like agent workflows—can be made inherently secure by embedding authorization checks directly into the data flow, rather than relying on separate, potentially insecure external services for managing dynamic access lists. The pattern of building complexity (authentication/authorization) at the core level to solve a specific use case (agent needs public endpoints) suggests a resistance to abstraction when security or privacy concerns are paramount.
What is the cost of this architectural shift? Does embedding policies on the local machine introduce new vectors for error, and how does the trust placed in the developer's configuration scale across diverse agent contexts? How do we ensure that the simplicity of "no account" does not mask a form of tacit, unverified trust within automated systems?