Authentication

InstaTunnel supports two levels of authentication: creating an account for enhanced features, and securing your tunnels with password protection or basic auth.

👤 Account Authentication

Creating an Account

# Register with your email

$ instatunnel auth login --email your@email.com

✅ Registration successful!

🔑 API key saved to config

📧 Verification email sent

# Now you can use enhanced features

$ instatunnel 3000 --subdomain myapp

✅ Tunnel created: https://myapp.instatunnel.my

Benefits of an Account:

• Custom subdomains and longer sessions
• Tunnel management across sessions
• Basic analytics and request logs
• API access for automation

Anonymous Usage

# Use InstaTunnel without an account

$ instatunnel 3000

✅ Tunnel created: https://k8m9n2.instatunnel.my

💡 Anonymous session - expires in 24 hours

💡 Create account for longer sessions

InstaTunnel works without signup for quick testing. Use CLI 1.1.24 or newer; anonymous tunnels get a random subdomain, and the CLI handles the private connection token automatically. Do not share that token. Anonymous use is limited to 2 active tunnels and 6 new tunnels per 24 hours per network, and is monitored for abuse; tunnels used for phishing are suspended automatically. Browser visitors see a one-time warning page; automated tests can send the X-InstaTunnel-Skip-Warning header to skip it. Sign in to choose a named subdomain and for higher limits.

Logout

# Remove stored credentials

$ instatunnel auth logout

✅ Logged out successfully

🗑️ API key removed from config

🔐 Tunnel Security

Password Protection

# Protect your tunnel with a password

$ instatunnel 3000 --password mypassword123

✅ Tunnel created: https://abc123.instatunnel.my

🔒 Password protection enabled

🔑 Visitors will be prompted for password

Password protection is available on Pro and Business. Visitors need to enter the password before accessing your tunnel.

Browser visitors see a password form. API and webhook clients can send the password directly:

X-InstaTunnel-Password: mypassword123

Webhook providers must support sending this header. If they cannot, use an unprotected endpoint and verify the provider's webhook signature in your app.

HTTP Basic Authentication

# Basic authentication with username:password

$ instatunnel 3000 --auth admin:secret123

✅ Tunnel created: https://abc123.instatunnel.my

🔐 Basic authentication enabled

👤 Username: admin

HTTP Basic Authentication is available on Pro and Business. Browsers display their native login prompt, while API clients can use credentials such as curl -u admin:secret123 https://abc123.instatunnel.my.

Security Best Practices

# Use environment variables for passwords

$ export TUNNEL_PASSWORD="mySecurePassword123!"

$ instatunnel 3000 --password $TUNNEL_PASSWORD

# Or for basic auth

$ export TUNNEL_AUTH="admin:secret123"

$ instatunnel 3000 --auth $TUNNEL_AUTH

🔒 Security: Never hardcode passwords in scripts or commit them to version control. Always use environment variables.

🎯 Authentication Comparison

Feature	Anonymous	With Account	Password/Auth
Setup Required	None	Email registration	Set --password or --auth
Session Duration	24 hours	24 hours (Free) / Unlimited (Pro)	Same as account level
Custom Subdomains	❌	✅	Same as account level
Visitor Warning Page	Shown once per browser	None	Same as account level
Tunnel Limits	2 active, 6 per 24 hours (per network)	Per plan	Same as account level
Tunnel Security	Public access	Public access	Protected access
Best For	Quick testing	Development	Demos, staging

💡 Recommended: Start with an updated CLI and a random anonymous tunnel for quick testing. Sign in for a named subdomain; Pro or Business is required for password protection and Basic Auth.

InstaTunnel docs wa doko kara hajimeru no ga yoi desu ka?

Evidence and trust

Release cadence

Security controls

Reliability runbooks

Documentation