qURL™ vs Cloudflare Tunnel + Access
A link per person, instead of a policy per app.
Cloudflare Tunnel puts your app on a hostname on your own Cloudflare domain, and an Access policy decides who gets in; someone outside your identity provider signs in with an emailed one-time PIN. qURL needs no account, domain, or policy: qurl share prints a link for one recipient that is single-use by default and expires within 24 hours.
Facts checked October 7, 2026 against each vendor’s documentation. Download the data
A named Cloudflare Tunnel for the route and Cloudflare Access for the gate is the setup most teams reach for when someone outside the company needs a private app. qURL replaces both for the short, one-recipient case, and leaves the lasting, many-user case to Cloudflare.
How qURL and Cloudflare Tunnel + Access differ
A named tunnel runs cloudflared on your machine, which connects outbound to Cloudflare, so no inbound port is needed. To publish the app on a hostname, you add your domain to Cloudflare, create the tunnel, and add a published application route. Without a Cloudflare Access application, anyone can reach the hostname. Access policies then list who may enter: emails, email domains, identity-provider groups, or service tokens for machines. Someone outside your identity provider signs in with a one-time PIN, a code Access emails to an allowed address that is valid for 10 minutes and works once. Access then sends the app a signed Cf-Access-Jwt-Assertion header that names the user.
qURL also connects out from your machine, but the app gets no public hostname. qurl publish registers the app and prints its CRID, and qurl share turns the CRID into a link for one recipient. With no flags the link opens once and expires within 24 hours, so there is no allow list to edit, no PIN to wait for, and nothing to undo when the work is done.
The two differ in what your app learns. Access tells the app who each user is. A qURL link grants access to whoever opens it and sends the app no identity, so keep your app’s own sign-in for anything that needs to know the user. A session admits the opener’s whole public IP address, so other devices on that network can reach the app while it lasts.
From a running app to a link you can send
qurl publish http://127.0.0.1:3000
qurl share <CRID>Create the tunnel in the dashboard, run the cloudflared install command it shows, then add a published application routeqURL and Cloudflare Tunnel + Access, side by side
| Question | qURL CLI | Cloudflare Tunnel (named) |
|---|---|---|
| Account needed before the first URL | No. The first publish creates the device identity our test | Yes: account plus a domain on Cloudflare developers.cloudflare.com |
| What the URL looks like | A qurl.link access link per recipient; the app answers at r_<id>.qurl.site, a name absent from Certificate Transparency logs our test | Stable hostname on your own domain developers.cloudflare.com |
| Who can reach it | No one until a link is opened; then the opener’s public IP for that session, including other devices behind that IP layerv.ai | Public unless you add a Cloudflare Access application developers.cloudflare.com |
| Warning page shown to visitors | None our test | Not documented developers.cloudflare.com |
| Visitor access control | Single-use access link by default; link and session lifetimes. IP allow and deny lists and other rules can gate links through the API, not the CLI layerv.ai | Cloudflare Access policies; service tokens for machines developers.cloudflare.com |
| Link expiry | Yes. qurl share returned a 24-hour link in our no-account test; no-account links are capped at 24 hours our test | No per-link expiry; Access session settings apply developers.cloudflare.com |
| Single-use links | Yes, the default for qurl share our test | Not documented developers.cloudflare.com |
| Protocols | HTTP(S), WebSocket, SSE; no raw TCP our test | HTTP(S); TCP, SSH, RDP, SMB with cloudflared on the client developers.cloudflare.com |
| Free-tier limits | Without an account: up to 3 active resources, with links that last up to 24 hours github.com | Available on all plans; 1,000 tunnels per account, 25 replicas per tunnel developers.cloudflare.com |
Which one to use
Choose qURL to
Send a client a preview, let a contractor look at one internal page this week, or hand an agent a private target, without a domain on Cloudflare, an Access application, or a policy edit. Each recipient gets their own link that works once and ends on its own.
When Cloudflare is the better choice
Choose Cloudflare Tunnel and Access for a lasting hostname on your own domain, for people already in your identity provider who need standing access, or when your app should learn who each user is from a signed header. Cloudflare Tunnel also carries TCP, SSH, RDP, and SMB with cloudflared on the client, which qURL does not.
Frequently Asked Questions
Do I need a domain on Cloudflare?
Yes, to publish an app on a hostname through a named tunnel: Cloudflare’s guide starts with adding your website to Cloudflare. Quick tunnels on trycloudflare.com skip the account and domain, but their address is public. The qURL CLI needs neither; without an account you get up to 3 active resources, with links that last up to 24 hours.
Can someone outside our identity provider get in through Access?
Yes, with a one-time PIN. Access emails a code, valid for 10 minutes and good for one sign-in, to an address your policy allows, and they paste it into the login page. They still have to be named in the policy first. A qURL recipient needs only the link you send.
How do I end one person’s access?
With Access, remove their policy allowance and revoke their active sessions. A qURL link with no flags stops working after one open or 24 hours on its own. With an account, you can revoke one link early through the API (DELETE /v1/resources/{id}/qurls/{qurl_id}) while other links keep working, and qurl stop <CRID> stops serving the app.
Can a script or an agent use it?
Cloudflare Access gives machines service tokens, sent as CF-Access-Client-Id and CF-Access-Client-Secret headers, that expire after the duration you set. qURL links can be issued with the SDK or API, and software opens them through a compatible SDK or the documented token-resolution API.
How is this different from a public tunnel?
A public tunnel exposes an endpoint and can protect it with authentication. With LayerV, your local app stays hidden from public scans. You create a private, expiring way in for one resource at a time. A teammate or AI agent can use the app without a public deployment or access to your wider network.
Who can open a qURL link?
Whoever holds it, once: with no flags, qurl share prints a single-use link. Opening it admits the network address it was opened from for the session, which lasts 1 hour by default for an app published from the CLI. Other devices on the same public IP address, such as an office or café network, can reach the app until the session ends, so keep your app’s own sign-in for anything sensitive. By default a link admits whoever opens it; access rules set through the API, such as IP allow and deny lists, can restrict that.
Share your app without an account
Paste one prompt into your coding agent, or install the qURL CLI and publish the app yourself. No sign-up, no API key.
New to qURL? Start at qurl.link