Share the dev build. Not with everyone.

A quick tunnel is public to anyone who finds the URL. A named tunnel puts your dev proxy at a hostname you own, with Cloudflare Access in front, and agnt checks the Access token again at the origin.

Narrated · 1:10. Recorded live: a real named tunnel, a real Access application, and the proxy started from the demo's own .agnt.kdl.

What happens

The config (0:04). One cloudflare-tunnel block on the proxy: the tunnel UUID, the hostname, the credential file, and the Access application's team domain and audience tag. agnt starts cloudflared when the proxy starts.

A stranger (0:18). curl to the public hostname gets a 302 to the Access login. Cloudflare's edge stops it before it reaches your machine.

Around the edge (0:32). Skip Cloudflare entirely: send a forged Cf-Access-Jwt-Assertion straight to the loopback ingress agnt opened for cloudflared. agnt verifies the token itself (RS256, the team's keys, issuer, audience, validity window) and answers 403.

An allowed caller (0:44). With an Access service token, the request passes the edge, passes agnt's check, and reaches the app.

In the browser (0:48). The Access login page for a stranger; for an allowed caller, the app, reporting that it was reached at https://agnt-demo.sbdev.io with X-Forwarded-Proto: https, so OAuth redirect URIs built from forwarded headers come out right.

Set it up

See Dev Sign-in & Protected Sharing for the block, the fail-closed rules, and the one-time provisioning agnt leaves to you (tunnel, DNS route, Access application).