Cloudflare Tunnel provides a secure method of connecting private servers, applications, web services, and internal infrastructure to Cloudflare without exposing the origin server directly to the public Internet.

A common administrative requirement is to allow an IT engineer, developer, consultant, or application administrator to create and configure a Named Cloudflare Tunnel without giving that person unrestricted administrative access to the entire Cloudflare account.

This is an important security distinction.

A technician who only needs to:

• create a Cloudflare Tunnel,
• install or configure cloudflared,
• configure a public hostname,
• create a required subdomain, and
• modify the associated DNS record

normally should not require access to billing, account membership, unrelated domains, subscriptions, or other sensitive Cloudflare settings.

The recommended approach is therefore based on the security principle of least privilege: grant only the permissions required to complete the task.

Note: Cloudflare regularly changes dashboard navigation, role names, API permission terminology, and Zero Trust product naming. Therefore, the exact wording visible in your Cloudflare account may differ slightly from the examples in this article.

1. What Is a Named Cloudflare Tunnel?

A Cloudflare Tunnel creates an outbound encrypted connection from a server running the cloudflared connector to Cloudflare's network.

Instead of exposing a service directly to the Internet using:

Public IP → Router → Port Forwarding → Server

the architecture becomes approximately:

User
   ↓
Cloudflare
   ↓
Cloudflare Tunnel
   ↓
cloudflared
   ↓
Internal Application / Server

Because cloudflared establishes the connection outbound, organizations can often publish applications without opening inbound ports on their Internet router or firewall.

For example, suppose an internal web application is running at:

http://192.168.1.50:8080

A public hostname could be configured as:

portal.example.com

Cloudflare Tunnel can route requests received for:

https://portal.example.com

to:

http://192.168.1.50:8080

without directly exposing 192.168.1.50 to the Internet.

2. What Does "Named Tunnel" Mean?

A Named Tunnel is a persistent Cloudflare Tunnel that has its own identity.

For example:

Office-Application-Tunnel

or:

ERP-Server-Tunnel

or:

Customer-Portal-Tunnel

Cloudflare associates the tunnel with a unique tunnel ID.

A DNS hostname may ultimately reference a destination resembling:

<TUNNEL-ID>.cfargotunnel.com

This allows Cloudflare to identify which Tunnel should receive traffic for the configured hostname.

3. Why Are Special Permissions Required?

Creating a functional public Cloudflare Tunnel usually involves two separate administrative areas.

A. Tunnel Management

The administrator must be permitted to create or manage Cloudflare Tunnels.

Depending on the Cloudflare dashboard/API version, terminology may include permissions such as:

Cloudflare Tunnel
Cloudflare Tunnel Write
Cloudflare One Connectors
Cloudflare One Connectors Write
Cloudflare One Connector: cloudflared

B. DNS Management

The administrator may also need permission to create or modify the DNS record associated with the public hostname.

For example:

portal.example.com

Therefore, Tunnel access alone may not be sufficient.

A typical least-privilege requirement is conceptually:

Tunnel = Write/Edit
DNS = Write/Edit

4. Do Not Share the Main Cloudflare Password

A common but insecure approach is to give a developer or technician the primary Cloudflare account username and password.

Avoid this.

It can potentially expose:

• every domain in the account,
• DNS records,
• billing information,
• security configuration,
• account membership,
• API credentials,
• Workers,
• Pages,
• SSL/TLS settings,
• firewall configuration,
• Zero Trust configuration,
• and other customer resources.

Instead, use Cloudflare's member/role system or an appropriately restricted API token.

5. Two Recommended Methods

There are generally two practical methods.

Method 1 – Invite a Cloudflare Member

Use this when a person needs to log into the Cloudflare dashboard and perform the configuration manually.

Method 2 – Create a Restricted API Token

Use this when an application, deployment system, script, automation, or administrator working through the Cloudflare API needs access.

For interactive work by another technician, member access is normally easier to manage and audit.

6. Method 1 – Grant Limited Cloudflare Member Access

Log into the Cloudflare dashboard using an account authorized to manage members.

Navigate to the account's member management section.

Depending on the current dashboard layout, this may appear under an area similar to:

Manage Account
      ↓
Members

Choose the option to invite/add a member.

Enter the technician's own email address.

Do not create a shared login.

Using individual accounts improves:

• accountability,
• access auditing,
• password security,
• MFA management,
• access revocation,
• and separation between administrators.

7. Grant Tunnel Management Permission

The invited member needs a role capable of managing Cloudflare Tunnel configuration.

Depending on the current Cloudflare interface and subscription, the permission may be represented by terminology such as:

Cloudflare Access

or Tunnel/Cloudflare One-related permissions.

The underlying requirement is:

Cloudflare Tunnel → Edit/Write

Do not grant a broad Administrator or Super Administrator role merely because a Tunnel needs to be created.

8. Grant DNS Permission

If the technician must configure a public hostname, DNS modification permission will normally also be necessary.

For example, suppose the organization owns:

example.com

and the required hostname is:

erp.example.com

The technician needs sufficient DNS permission for example.com to create or modify the necessary record.

Conceptually, the required permission is:

Zone
   ↓
DNS
   ↓
Edit

or the equivalent DNS write permission exposed by the applicable Cloudflare interface.

9. Restrict DNS Permission to the Required Domain

This is one of the most important security measures.

Suppose a Cloudflare account contains:

example.com
company-a.com
company-b.in
customerportal.net
internalservices.in

and the technician only needs to configure:

example.com

Do not give DNS Edit permission for all zones unless there is a genuine operational requirement.

Instead, use a scope similar to:

Zone Resources

Include
   ↓
Specific Zone
   ↓
example.com

This limits the potential impact of accidental or unauthorized DNS changes.

10. Recommended Permission Structure

A restricted configuration can be designed approximately as follows:

Resource	Permission	Scope
Cloudflare Tunnel	Edit/Write	Required Account
DNS	Edit	Required Domain/Zone
Billing	None	No Access
Members	None	No Access
Account Administration	None	No Access
Workers	None unless required	No Access
Firewall/WAF	None unless required	No Access
Other Domains	None	No Access

This provides the permissions needed for Tunnel deployment without unnecessarily exposing unrelated Cloudflare resources.

11. Technician Accepts the Invitation

After the invitation is sent, the technician should receive an email from Cloudflare.

The technician should:

1. Open the Cloudflare invitation.
2. Sign in using their own Cloudflare account.
3. Accept the invitation.
4. Switch to the delegated Cloudflare account.
5. Confirm that only the intended resources are accessible.

If possible, require Multi-Factor Authentication for administrator accounts.

12. Creating the Named Cloudflare Tunnel

After the permissions are active, open the Tunnel management area.

Depending on the current Cloudflare dashboard version, Tunnel management may appear under areas such as:

Networking
   ↓
Tunnels

or within Cloudflare Zero Trust / Cloudflare One networking options.

Select:

Create a tunnel

Choose the cloudflared connector when appropriate.

Enter a descriptive Tunnel name.

For example:

Production-Web-Tunnel

Avoid generic names such as:

Tunnel1

Good naming conventions become increasingly important when an organization operates many tunnels.

13. Recommended Tunnel Naming Convention

A useful naming convention is:

<Location>-<Application>-<Environment>

Examples:

Delhi-ERP-Production
Mumbai-CRM-Production
Office-WebApp-Test
Branch01-Intranet-Production

This makes administration and troubleshooting easier.

14. Install cloudflared on the Origin Server

The server that will establish the Tunnel needs the cloudflared connector.

For Windows environments, Cloudflare normally provides an installation command during Tunnel configuration.

A command may conceptually resemble:

cloudflared.exe service install <TUNNEL_TOKEN>

Use the exact command generated by your Cloudflare dashboard.

The Tunnel token authenticates the connector to the corresponding Cloudflare Tunnel.

15. The Tunnel Token Is Sensitive

Treat the Tunnel token as a credential.

Do not publish it in:

• public documentation,
• screenshots,
• WhatsApp groups,
• public tickets,
• GitHub repositories,
• knowledgebase articles,
• forums,
• email signatures,
• or source-code repositories.

A person obtaining a valid Tunnel token may be able to run a connector associated with that Tunnel.

When sharing screenshots for troubleshooting, redact the token.

16. Verify Tunnel Connectivity

Once cloudflared is installed and running, return to the Cloudflare dashboard.

The Tunnel should transition to a connected/healthy state when the connector successfully communicates with Cloudflare.

If it remains disconnected, investigate:

• Internet connectivity,
• DNS resolution,
• firewall rules,
• proxy restrictions,
• cloudflared service status,
• incorrect tokens,
• TLS inspection,
• endpoint security restrictions,
• and outbound network policies.

17. Configure a Public Hostname

Suppose the application should be available as:

portal.example.com

and the internal application runs at:

http://192.168.1.50:8080

Configure a public hostname approximately as follows:

Subdomain: portal

Domain: example.com

Type: HTTP

URL:
http://192.168.1.50:8080

The resulting path becomes:

Internet User
       ↓
https://portal.example.com
       ↓
Cloudflare
       ↓
Cloudflare Tunnel
       ↓
cloudflared
       ↓
http://192.168.1.50:8080

18. Understanding the DNS Record

Cloudflare Tunnel commonly associates the hostname with the Tunnel through a CNAME-style relationship.

Conceptually:

portal.example.com
          ↓
<TUNNEL-ID>.cfargotunnel.com

The DNS entry tells Cloudflare that traffic for the hostname belongs to the specified Tunnel.

This explains why DNS Edit permission is commonly required in addition to Tunnel Write permission.

19. Why "Cloudflare Tunnel Write" May Not Appear Exactly

Cloudflare's terminology has evolved.

Documentation, APIs and dashboard interfaces may refer to related permissions using different names, including:

Cloudflare Tunnel Write

Cloudflare One Connectors Write

or:

Cloudflare One Connector: cloudflared

Do not assume that all three permissions must always be granted simultaneously.

The objective is to provide the required write/edit capability for Cloudflare Tunnel/cloudflared connector management.

The exact permission displayed depends on the Cloudflare interface, API endpoint, account configuration, and product version.

20. Method 2 – Create a Restricted API Token

If the administrator or application does not require interactive dashboard access, an API token may be preferable.

Open the Cloudflare profile/API token management section and choose:

Create Token

Then:

Create Custom Token

Give the token a descriptive name.

For example:

Production Tunnel Deployment

Avoid vague names such as:

API Token 1

21. Configure Tunnel Permission in the API Token

The permission should provide the necessary Tunnel editing capability.

A typical configuration is conceptually:

Account
   ↓
Cloudflare Tunnel
   ↓
Edit

Depending on Cloudflare's current API permission terminology, this may correspond to Tunnel or Cloudflare One connector write access.

22. Add DNS Permission to the API Token

If the same API token must create the associated DNS record, add:

Zone
   ↓
DNS
   ↓
Edit

Therefore, the basic token permission model becomes:

Account → Cloudflare Tunnel → Edit

Zone → DNS → Edit

23. Restrict the Account Scope

Where possible, specify the exact Cloudflare account:

Account Resources

Include
   ↓
Specific Account
   ↓
Required Account

Avoid granting the token access to unrelated Cloudflare accounts.

24. Restrict the Zone Scope

Similarly, restrict DNS access:

Zone Resources

Include
   ↓
Specific Zone
   ↓
example.com

Avoid:

All Zones

unless the automation genuinely needs to modify every domain.

25. Example Least-Privilege API Token

A secure token might therefore look conceptually like:

Token Name:
Production Tunnel Deployment

ACCOUNT PERMISSION
Cloudflare Tunnel → Edit

ACCOUNT RESOURCE
Specific Account → Required Account

ZONE PERMISSION
DNS → Edit

ZONE RESOURCE
Specific Zone → example.com

This is substantially safer than using a Global API Key.

26. API Token vs Global API Key

Whenever possible, prefer:

Restricted API Token

instead of:

Global API Key

A restricted API token can be limited by:

• permission,
• account,
• zone,
• resource,
• and potentially other policy conditions.

A Global API Key has much broader implications if exposed.

27. Member Access vs API Token

Requirement	Recommended Method
Technician needs Cloudflare dashboard	Member Access
Script needs Cloudflare API	API Token
CI/CD deployment	API Token
External consultant configuring manually	Restricted Member
Automated DNS modification	API Token
One-time manual Tunnel deployment	Restricted Member
Application integration	API Token

Neither method should automatically receive unrestricted administrative rights.

28. Granular Permissions for Existing Tunnels

Cloudflare also supports more granular approaches for managing specific Tunnel resources in applicable configurations.

This can be useful when multiple tunnels exist:

Production-Tunnel
Development-Tunnel
Customer-A-Tunnel
Customer-B-Tunnel

A technician responsible only for:

Customer-A-Tunnel

should ideally not be able to modify:

Production-Tunnel

if the account's available permission model allows that separation.

29. Important Limitation When Creating a New Tunnel

Granular permissions are especially useful after a Tunnel already exists.

There is an important logical difference between:

Create a new Tunnel

and:

Manage an existing Tunnel

A new Tunnel does not yet have an individual Tunnel resource that can be selected.

Therefore, creation may initially require broader account-level Tunnel creation permission.

After deployment, permissions can be reviewed and reduced where Cloudflare's current role model supports doing so.

30. Security Hardening After Deployment

After the Tunnel is operational, review the technician's permissions.

Ask:

• Does the person still need to create new Tunnels?
• Do they still need DNS Edit access?
• Do they need access to the entire zone?
• Can access be restricted to an existing Tunnel?
• Was a temporary API token created?
• Can the token now be revoked?
• Is MFA enabled?
• Are unused Cloudflare members still active?

Temporary administrative permissions should not become permanent by accident.

31. Cloudflare Tunnel Is Not Automatically Application Authentication

This is an important security concept.

Publishing:

portal.example.com

through a Cloudflare Tunnel does not automatically mean that only authorized employees can use the application.

Tunnel connectivity and user authentication are separate concerns.

For sensitive internal applications, consider implementing Cloudflare Access/Zero Trust policies or another appropriate authentication layer.

For example:

User
   ↓
Cloudflare Access Authentication
   ↓
Cloudflare
   ↓
Tunnel
   ↓
Internal Application

This can be significantly safer than exposing an internal application to anyone who knows its public hostname.

32. Do Not Expose Sensitive Services Without Proper Controls

Be particularly careful with:

• server administration panels,
• NAS interfaces,
• accounting applications,
• ERP systems,
• database administration interfaces,
• remote desktop gateways,
• router management,
• hypervisor consoles,
• backup servers,
• CCTV management interfaces,
• and internal business applications.

A Cloudflare Tunnel provides connectivity, but application security still matters.

Use appropriate authentication, authorization, updates, logging, and Zero Trust controls.

33. Avoid Unnecessary Permissions

Do not automatically grant permissions for:

Billing
Members
Workers
Pages
Registrar
Account Administration
WAF
SSL
Load Balancing

simply because somebody is configuring a Tunnel.

Grant an additional permission only when the required Cloudflare operation specifically depends on it.

34. Troubleshooting "Insufficient Permissions"

If the technician receives errors such as:

Unauthorized

Access Denied

Insufficient Permissions

or cannot create the public hostname, check the permissions separately.

First check Tunnel permission:

Cloudflare Tunnel → Edit/Write

Then check DNS permission:

DNS → Edit

Then verify resource scope:

Correct Account?
Correct Zone?

A user may have DNS Edit permission but for the wrong domain.

Similarly, the user may have Tunnel permissions but for the wrong Cloudflare account.

35. Common Mistake: Tunnel Works but Hostname Cannot Be Created

Suppose the technician successfully creates:

Production-Tunnel

but receives an error while adding:

portal.example.com

This frequently indicates that Tunnel permissions are sufficient but DNS permissions are missing or incorrectly scoped.

Verify:

Zone → DNS → Edit

for:

example.com

36. Common Mistake: DNS Permission Exists but Tunnel Cannot Be Created

The reverse situation can also occur.

The technician can create DNS records but cannot create the Tunnel.

That means:

DNS → Edit

does not automatically provide:

Tunnel → Edit

These are separate Cloudflare resources.

Grant the appropriate Cloudflare Tunnel/Cloudflare One connector write capability.

37. Common Mistake: Giving Super Administrator Access

An administrator may think:

"The technician needs to create one Tunnel, so I will make them Super Administrator."

This solves the permission problem by creating a much larger security problem.

The technician may gain control over unrelated Cloudflare resources.

Always try:

Tunnel Write/Edit
+
Required Zone DNS Edit

before considering broader privileges.

38. Common Mistake: Giving DNS Edit to Every Domain

Another common configuration is:

Zone Resources → All Zones

when only one domain is required.

Instead use:

Zone Resources
   ↓
Specific Zone
   ↓
example.com

This protects other customer and organizational domains from accidental changes.

39. Common Mistake: Sharing Tunnel Tokens in Screenshots

Tunnel setup screens may display sensitive commands containing authentication information.

Before sharing screenshots with:

• support providers,
• vendors,
• forums,
• AI tools,
• WhatsApp,
• email,
• ticketing systems,

inspect the image carefully.

Redact:

Tunnel Tokens
API Tokens
API Keys
Passwords
Secrets
Private Keys

40. Recommended Deployment Workflow

A secure deployment can follow this sequence:

1. Identify the exact domain.

2. Identify the internal application/service.

3. Determine whether dashboard access or API access is required.

4. Create a separate member or restricted API token.

5. Grant Tunnel Edit/Write.

6. Grant DNS Edit only for the required zone.

7. Create the Named Tunnel.

8. Install cloudflared.

9. Confirm Tunnel connectivity.

10. Configure the public hostname.

11. Verify DNS.

12. Test the application.

13. Add application authentication/Cloudflare Access where required.

14. Review logs.

15. Reduce or remove temporary administrative permissions.

This approach combines functionality with reasonable administrative security.

FAQ

1. What permission is required to create a Named Cloudflare Tunnel?

The account or API token needs a Cloudflare Tunnel/Cloudflare One connector permission that provides Edit or Write capability. The exact permission name may differ between Cloudflare dashboard and API versions.

2. Do I need all of "Cloudflare One Connectors Write", "Cloudflare One Connector: cloudflared Write" and "Cloudflare Tunnel Write"?

Not necessarily. These names can represent alternative or evolving Cloudflare permission models. Grant the specific write/edit permission required by the operation and interface being used rather than automatically granting every similarly named permission.

3. Why is DNS Edit permission required?

A public hostname such as portal.example.com needs an associated DNS configuration pointing traffic toward the Tunnel.

4. Can I give access to only one domain?

Yes. Where supported by the applicable role/token configuration, restrict the zone resource to the specific domain instead of selecting all zones.

5. Should I give the technician my Cloudflare password?

No. Invite them using their own account or create a restricted API token when API access is more appropriate.

6. Should I make the technician Super Administrator?

Normally no. Use least-privilege Tunnel and DNS permissions unless additional administrative capabilities are genuinely required.

7. What is cloudflared?

cloudflared is Cloudflare's connector software that establishes the outbound connection between the origin environment and Cloudflare's network.

8. Does Cloudflare Tunnel require port forwarding?

One major advantage of Cloudflare Tunnel is that the connector initiates outbound connections, so traditional inbound port forwarding is generally unnecessary for services routed through the Tunnel.

9. Does the server need a public static IP?

A traditional publicly reachable static IP is generally not required for Cloudflare Tunnel because cloudflared initiates outbound connectivity.

10. Can Cloudflare Tunnel work behind NAT?

Yes. Its outbound connector model makes it useful for networks behind NAT, subject to the required outbound connectivity being permitted.

11. What is cfargotunnel.com?

Cloudflare uses Tunnel-specific destinations under cfargotunnel.com when associating hostnames with Cloudflare Tunnels.

12. Is the Tunnel token confidential?

Yes. Treat it as a sensitive credential and never publish it.

13. Can I revoke the Tunnel token?

Credentials should be rotated or revoked if they are exposed or no longer required, using the controls available for the applicable Tunnel configuration.

14. Can I restrict someone to a specific Tunnel?

Cloudflare provides granular Tunnel permission capabilities in applicable configurations. This is particularly useful for already-created Tunnels.

15. Why might creating a new Tunnel require broader permission?

A new Tunnel does not yet exist as an individual resource. Therefore, creating it may require account-level permission capable of creating Tunnel resources.

16. Can I remove the technician after setup?

Yes. If continued access is unnecessary, revoke the member's access or remove/disable the temporary credential after deployment.

17. Can the technician create a subdomain?

If the technician has appropriate DNS Edit permission for the required zone, they can create the DNS record needed for a subdomain such as app.example.com.

18. Does DNS Edit permission allow changing my website DNS?

Potentially yes within the zone covered by the permission. That is why DNS Edit should be granted only to trusted administrators and scoped as narrowly as possible.

19. Is an API Token safer than a Global API Key?

A properly restricted API token is generally preferable because it can be scoped to specific permissions and resources.

20. Should I use a Global API Key for Tunnel deployment?

Avoid it when a restricted API token can accomplish the required operation.

21. Can I create multiple Named Tunnels?

Yes. Organizations can operate multiple Tunnels for different locations, environments, servers, or applications.

22. Should I use different Tunnels for production and testing?

Separating production and development/test environments can improve security, troubleshooting, and change management.

23. Can one Tunnel publish multiple applications?

Cloudflare Tunnel can route multiple hostnames/services through an appropriate Tunnel configuration.

24. Does Cloudflare Tunnel encrypt traffic?

The connector establishes secure outbound connections to Cloudflare. However, the security of the entire application path also depends on how the origin service and application are configured.

25. Does a Tunnel automatically protect my application with a login screen?

No. Tunnel connectivity and user authorization are different things. Use Cloudflare Access or another appropriate authentication mechanism when access must be restricted.

26. Can I use Cloudflare Access with a Tunnel?

Yes. Cloudflare Access can be used to enforce identity-based policies before users reach applications published through Cloudflare.

27. Why does my Tunnel show disconnected?

Check the cloudflared service, Internet connectivity, DNS resolution, firewall restrictions, proxy configuration, token validity, and endpoint security software.

28. Why can the user create the Tunnel but not the hostname?

The most likely permission-related reason is missing or incorrectly scoped DNS Edit access.

29. Why can the user edit DNS but not create a Tunnel?

DNS and Tunnel permissions are separate. DNS Edit does not grant Tunnel Write/Edit.

30. Should billing permission be provided?

Not for ordinary Tunnel creation unless some separate task specifically requires it.

31. Does the technician need Members permission?

Not normally. Tunnel deployment does not inherently require permission to manage other Cloudflare account members.

32. Does the technician need SSL/TLS administration?

Not automatically. Grant it only when the deployment specifically requires SSL/TLS configuration outside the normal Tunnel workflow.

33. Does the technician need WAF permission?

Not merely to create a Tunnel. WAF administration should remain separate unless firewall/security rule management is part of the assignment.

34. Can Cloudflare Tunnel expose localhost applications?

Yes. A service running on the same machine as cloudflared can be configured using an appropriate local service URL, such as http://localhost:8080.

35. Can it connect to another LAN computer?

Yes, provided the system running cloudflared can reach that LAN service and network/firewall rules allow the connection.

36. Should Tunnel names identify the server?

Using descriptive names containing the location, application, or environment makes long-term management easier.

37. What happens if someone steals an API token?

The potential damage depends on the token's permissions and resource scope. This is exactly why least-privilege API tokens are strongly recommended.

38. Should API tokens be stored in source code?

No. Use a suitable secrets-management mechanism or protected environment configuration.

39. Should Tunnel credentials be uploaded to GitHub?

No. Tunnel tokens, API tokens, keys, and other secrets should never be committed to public repositories.

40. Can Cloudflare dashboard terminology change?

Yes. Cloudflare periodically reorganizes products and permission names. Always verify the current documentation and the permissions shown in your own dashboard.

Conclusion

Creating a Named Cloudflare Tunnel does not require giving a technician unrestricted control of the entire Cloudflare account.

The basic least-privilege model is:

Cloudflare Account
       │
       ├── Tunnel → Edit/Write
       │
       └── Required Domain
                │
                └── DNS → Edit

For a human administrator, use a restricted Cloudflare member account.

For scripts, deployment systems, or API integrations, use a restricted API token.

Where possible, scope DNS permissions to the exact required domain and avoid unnecessary access to other zones, billing, account membership, Workers, WAF, or unrelated Cloudflare services.

After the Tunnel is created and working, review the permissions again. Temporary creation privileges can often be reduced or removed.

Finally, remember that a Cloudflare Tunnel solves the problem of secure connectivity to an origin; it does not by itself replace application authentication, authorization, patching, monitoring, or other security controls. Sensitive internal applications should be protected with an appropriate authentication mechanism such as Cloudflare Access or another suitable identity-aware security layer.

Disclaimer: Cloudflare continuously updates its dashboard, Cloudflare One/Zero Trust products, APIs, role names, and permission structures. Menu paths and permission labels described in this article may therefore change over time. Always verify the current Cloudflare documentation and the permissions displayed in your own account before granting access. Follow the principle of least privilege and consult a qualified network/security professional for production or security-sensitive deployments.

#Tags

#Cloudflare #CloudflareTunnel #NamedTunnel #Cloudflared #CloudflareZeroTrust #CloudflareOne #CloudflareDNS #DNSManagement #CloudflareSecurity #CloudflareAccess #CloudflareAPI #APIToken #CloudflarePermissions #TunnelPermissions #DNSPermissions #CloudSecurity #ZeroTrust #NetworkSecurity #CyberSecurity #SecureRemoteAccess #ReverseTunnel #ReverseProxy #CloudflareConnector #PublicHostname #DNSRecords #CNAME #Subdomain #CloudflareDashboard #CloudflareSetup #CloudflareGuide #CloudflareTutorial #WindowsServer #ServerSecurity #NetworkAdministration #ITAdministration #SystemAdministrator #WebSecurity #ApplicationSecurity #LeastPrivilege #AccessControl #IdentitySecurity #CloudflareAccessPolicy #CloudflareNetworking #RemoteAccess #InfrastructureSecurity #APIsecurity #TunnelSecurity #CloudflareConfiguration #TechnicalGuide #ITSecurity