Passwords & email sign-in

A tunnel is public: anyone with the address can open it. To keep a preview private, protect it.

Password

tunnelpad share 8000 --auth=client:preview

Visitors' browsers ask for the user name and password (client and preview here). To keep the password out of your shell history, set it in the environment instead:

TUNNELPAD_AUTH=client:preview tunnelpad share 8000

Email sign-in

tunnelpad share 8000 --magic-auth

Visitors enter their email address before they see the site, and stay signed in for 7 days. You can limit it to certain addresses or domains:

tunnelpad share 8000 --magic-auth=@acme.com,jane@example.com

Email addresses aren't verified: this keeps casual visitors out and tells you who's looking, but it isn't strong security. Use a password, or your app's own login, for anything sensitive.

Protection works on every plan, and webhooks can't get through it either, so don't protect a tunnel you're using to receive webhooks.