Protect a tunnel with an access token

Before you begin

• A durable tunnel.
• A plan that includes access tokens (Starter and higher).

What to know before you start

• The token is shown once. Copy it before you close the dialog; if you lose it, create a new one.
• Creating or replacing a token ends the tunnel's live connection. Your connector reconnects on its own.

Steps

1. Step 1. Open the tunnel in the dashboard and choose Access token, then Create token.

   You should see: A dialog shows your access token once.

2. Step 2. Copy the token and keep it somewhere private.

   You should see: You have the token in your password manager or your secret store.

3. Step 3. Send the token with each request.

   Send it in the X-InstaWormhole-Token header, or as a bearer token in the Authorization header.

   curl -H "X-InstaWormhole-Token: <token>" https://example.instawormhole.site/

   curl -H "Authorization: Bearer <token>" https://example.instawormhole.site/

   Replace <token> with your token and example with your tunnel's name. The tunnel checks the token and does not pass it to your app, so your app can keep its own authentication.

   You should see: The request reaches your app and returns its answer.

   To check: Send the same request without the header. The tunnel answers 401.

You are done when

• A request without the token is refused.
• A request with the token reaches your app.

What to do next

• Use a token with an AI or MCP server

If something goes wrong

You lost the token.

Create a new token with Replace access token. The old token stops working. The token cannot be read back.

Requests with the token are still refused.

Check that the header name is spelled exactly X-InstaWormhole-Token, or that the Authorization header starts with Bearer and a space.

Undo or clean up

• To remove token protection, choose Remove access token on the tunnel.

Related

• Choose who can visit a tunnel
• Set a password on a tunnel
• Use an MCP server from an AI client