cloudflare-tunnel access-control agent-workflows dev-tools

Quick Tunnels gain email access control via flag

cloudflared 2026.9.3 adds --allowed-mail to gate Quick Tunnel access by email address with one-time PIN verification, no account required.

Summary

Agents can now share local dev servers safely without exposing them publicly. Developers can enforce access policy at the connector level while keeping guest lists off Cloudflare's servers.

Why it matters

Agents can now share local dev servers safely without exposing them publicly. Developers can enforce access policy at the connector level while keeping guest lists off Cloudflare's servers.

Implementation verdict

Replaces manual DNS/dashboard access control for temporary shares. Requires cloudflared 2026.9.3+ and updating agent instructions to pass --allowed-mail flags. Ready now: single-flag syntax, works in wrangler, scales from one email to wildcard domains.

Sources

1.Starting with cloudflared 2026.9.3, you can add --allowed-mail to the command, and your Quick Tunnel only lets in the email addresses and domains you choose.
2.your guest list never leaves your machine. Cloudflare learns that a tunnel requires email authentication. It doesn't learn who you invited.
3.Add --output json and every log line becomes a JSON object, so the agent can pick out the URL without scraping text.
4.Visitors prove they own one of those addresses with a one-time PIN from Cloudflare Access. Nobody, on either side, needs a Cloudflare account.

Dev Signal

Get briefs like this in your inbox — free, every weekday.

100+ sources compressed into one 4-minute read. Ranked, cited, implementation-ready.

Read the full issue →All briefs