Share a dev server with OAuth in one command

Choose who can open your local app with an email allow-list.

After installing tunn and completing the one-time login, run this for a dev server already listening on port 3000:

tunn 3000 --allow=alice@example.com

Replace the address with your teammate's verified email. Copy the HTTPS URL printed by tunn and send it to them. Keep the local app and tunn running while they use it.

First-time setup

curl -fsSL https://tunn.to/install.sh | sh
tunn login

The CLI prompts you to finish login in a browser. The single sharing command above assumes that setup is complete.

What happens when someone opens the link?

An unauthenticated browser is sent to tunn's login page. The visitor signs in to a personal account with an allowed email, using Google or an email link where offered by the relay. tunn checks the account's verified emails against your allow-list before forwarding the request to the local app. The creator is also allowed. An allow-list does not force visitors to use only OAuth.

Your teammate needs a browser, without a tunn CLI installation. The relay checks access before forwarding to your app, so this sharing rule does not require adding a login screen to your app.

Allow several people or a domain

tunn 3000 --allow=alice@example.com,bob@example.com
tunn 3000 --allow=@example.com

Run one of these variants. Domain sharing admits accounts with a verified email in that domain. Choose the smaller list when you want only specific people to open the app.

Check the boundary

Try the URL in a signed-out browser: it should ask you to log in. An authenticated account outside the allow-list should receive an access denial. An allowed account should reach your app.

Updated CLI web tunnels are owner-only by default. Use --allow to initialize sharing, or manage live person access at Share access. Use --public only when anonymous access is intended. Stop the tunn process when the sharing session is over. Keep your application's own authentication if it needs additional permissions.

Looking for another workflow? Read the ngrok comparison or publish a local MCP server for a remote connector.