Cloudflare Quick Tunnels add email-based access controls

Cloudflare announced protected Quick Tunnels on 2 October. Starting with cloudflared 2026.9.3, the allowed-mail option restricts a temporary tunnel to specified email addresses or domains. Visitors verify control of their mailbox with a one-time PIN through Cloudflare Access. Neither the person sharing the service nor the visitor needs a Cloudflare account.

Cloudflare Access verifies the email address, while the local connector checks it against the permitted list. The company says that list stays on the developer’s machine. A tunnel started without the option remains public to anyone holding its URL. Changing the list requires restarting the tunnel; stopping the connector ends access. Stable hostnames and more elaborate identity policies remain separate use cases.