Authentication

InstaTunnel supports two levels of authentication: creating an account for enhanced features, and securing your tunnels with password protection or basic auth.

👤 Account Authentication

Creating an Account

# Register with your email

$ instatunnel auth login --email your@email.com

✅ Registration successful!

🔑 API key saved to config

📧 Verification email sent

# Now you can use enhanced features

$ instatunnel 3000 --subdomain myapp

✅ Tunnel created: https://myapp.instatunnel.my

Benefits of an Account:

• Custom subdomains and longer sessions
• Tunnel management across sessions
• Basic analytics and request logs
• API access for automation

Anonymous Usage

# Use InstaTunnel without an account

$ instatunnel 3000

✅ Tunnel created: https://k8m9n2.instatunnel.my

💡 Anonymous session - expires in 24 hours

💡 Create account for longer sessions

InstaTunnel works without signup for quick testing. Use CLI 1.1.24 or newer; anonymous tunnels get a random subdomain, and the CLI handles the private connection token automatically. Do not share that token. Anonymous use is limited to 2 active tunnels and 6 new tunnels per 24 hours per network, and is monitored for abuse; tunnels used for phishing are suspended automatically. Browser visitors see a one-time warning page; automated tests can send the X-InstaTunnel-Skip-Warning header to skip it. Sign in to choose a named subdomain and for higher limits.

Logout

# Remove stored credentials

$ instatunnel auth logout

✅ Logged out successfully

🗑️ API key removed from config

🔐 Tunnel Security

Password Protection

# Protect your tunnel with a password

$ instatunnel 3000 --password mypassword123

✅ Tunnel created: https://abc123.instatunnel.my

🔒 Password protection enabled

🔑 Visitors will be prompted for password

Password protection is available on Pro and Business. Visitors need to enter the password before accessing your tunnel.

Browser visitors see a password form. API and webhook clients can send the password directly:

X-InstaTunnel-Password: mypassword123

Webhook providers must support sending this header. If they cannot, use an unprotected endpoint and verify the provider's webhook signature in your app.

HTTP Basic Authentication

# Basic authentication with username:password

$ instatunnel 3000 --auth admin:secret123

✅ Tunnel created: https://abc123.instatunnel.my

🔐 Basic authentication enabled

👤 Username: admin

HTTP Basic Authentication is available on Pro and Business. Browsers display their native login prompt, while API clients can use credentials such as curl -u admin:secret123 https://abc123.instatunnel.my.

Security Best Practices

# Use environment variables for passwords

$ export TUNNEL_PASSWORD="mySecurePassword123!"

$ instatunnel 3000 --password $TUNNEL_PASSWORD

# Or for basic auth

$ export TUNNEL_AUTH="admin:secret123"

$ instatunnel 3000 --auth $TUNNEL_AUTH

🔒 Security: Never hardcode passwords in scripts or commit them to version control. Always use environment variables.

🎯 Authentication Comparison

Feature	Anonymous	With Account	Password/Auth
Setup Required	None	Email registration	Set --password or --auth
Session Duration	24 hours	24 hours (Free) / Unlimited (Pro)	Same as account level
Custom Subdomains	❌	✅	Same as account level
Visitor Warning Page	Shown once per browser	None	Same as account level
Tunnel Limits	2 active, 6 per 24 hours (per network)	Per plan	Same as account level
Tunnel Security	Public access	Public access	Protected access
Best For	Quick testing	Development	Demos, staging

💡 Recommended: Start with an updated CLI and a random anonymous tunnel for quick testing. Sign in for a named subdomain; Pro or Business is required for password protection and Basic Auth.

Where should I start in InstaTunnel docs?

Evidence and trust

Release cadence

Security controls

Reliability runbooks

Documentation