Explanation
Choose who can visit a tunnel
Pick the right way to limit who can open a tunnel, and know what each one does.
- Applies to
- All plans; password, token and IP lists need Starter or higher
- Time
- About 3 minutes to read
- What it changes
- None. This page explains; it changes nothing.
- Last reviewed
- , by Product documentation
The choices
| Control | What it does | Plan |
|---|---|---|
| Anyone with the address | No check. Anyone who has the address can open it. | All plans |
| Password | The browser asks for a password before the request reaches your app. | Starter and higher |
| Access token | The request must carry a secret token in a header. Suits scripts, AI clients and webhook providers that cannot type a password. | Starter and higher |
| IP allow or deny list | Only requests from the networks you list, or everyone except those networks, may reach the tunnel. | Starter and higher |
| Expiry, pause and stop | End access after a time, or switch the tunnel off yourself. | All plans |
A tunnel has one access mode at a time: anyone, a password or a token. An IP list works on top of any of them.
Which one to use
- A browser visitor, such as a client reviewing a demo: a password.
- A script, a test run or an AI client that cannot answer a password prompt: an access token.
- A service that always calls from known addresses: an IP allow list.
- A short demo: set an expiry so the address stops on its own.
What to know
What to do next
Related
This page is part of Share and protect. Still stuck? Contact support.