Cloudflare Tunnel

Use a tunnel in your own Cloudflare account to reach an environment from other devices, such as your phone on mobile data, without opening router ports. You choose the address, for example https://vc.example.com. If you would rather not manage a domain, use VC Connect instead.

The tunnel only provides a route. Every device still needs a pairing link before it can use the environment, and the web client asks you to sign in to your VC account.

What you need

A Cloudflare account. The free plan is enough.
A domain that is active in that same account. The tunnel can only publish hostnames from domains in its own account.
- If your domain is registered elsewhere, add it in the Cloudflare dashboard and change its nameservers at your registrar to the two Cloudflare gives you. Wait until the domain shows Active.
- If you have no domain, you can buy one under Domain Registration. It is active in your account right away.

A subdomain of a domain you already use, such as vc.example.com, works fine and leaves your existing site untouched.

1. Create the tunnel

Open Cloudflare Zero Trust and go to Networks → Tunnels. Choose Create a tunnel, then Cloudflared.
Name the tunnel, for example vc.
On the install step, copy the token, the long value starting with eyJ in the install command. Do not run the command: VC runs cloudflared for you.

2. Publish a hostname

In the tunnel, open Published application routes (older dashboards call it Public Hostnames) and add a route:

Field	Value
Subdomain	The name you want, for example `vc`
Domain	Your domain, for example `example.com`
Path	Leave empty
Type	`HTTP`
URL	`localhost:<port>`, the local address VC shows during setup

Check that Full hostname reads exactly the address you expect, such as vc.example.com, before you save. Cloudflare creates the DNS record for you.

Open Settings → Connections → Cloudflare Tunnel to see the local HTTP service address and copy it from the setup dialog. It shows the port on the machine running VC, even when you are connected from another device. Use that port for the route instead of the port in your browser’s address bar.

3. Connect VC to the tunnel

Desktop app: open Settings → Connections, choose Set up next to Cloudflare Tunnel, and enter the public URL (https://vc.example.com) and the token. If cloudflared is not installed yet, VC asks before downloading it. The row shows Connecting… and then the address other devices can use.

Command-line host: save the tunnel, then restart the server:

VC_CLOUDFLARE_TUNNEL_TOKEN=<token> npx vc tunnel set --public-url https://vc.example.com

Passing the token through the environment keeps it out of your shell history. npx vc tunnel status shows the saved address.

4. Pair your devices

Pairing links now use the public address. In Settings → Connections, create a link or code, or run npx vc pair on a command-line host, then open it on the other device. The startup link printed by npx vc serve uses the public address too.

The hosted app at app.vce.codes and the mobile apps can connect through the tunnel because it is served over HTTPS.

Change or remove the tunnel

Choose Change to use a new token or address, or Turn off to stop the tunnel. On a command-line host, run npx vc tunnel clear and restart the server.

Turn off is unavailable on a device connected through the tunnel itself, since it would lose its connection with no way back. Turn the tunnel off from the host or from another connection.

Treat the token like a password. If it leaks, delete the tunnel in Cloudflare, create a new one, and enter its token in VC.

Troubleshooting

What you see	What to check
The browser cannot find the address	The route is missing or publishes another name. Check that Full hostname in the route matches the public URL exactly; a name like `vc.vc.example.com` or one without your real domain means the wrong Domain was selected. In DNS, the domain needs a proxied `CNAME` record for the subdomain.
Your domain is not in the route’s Domain list	The domain is in a different Cloudflare account. Create the tunnel in the account where the domain is active.
The address works on other devices but not on the host	The host remembers the earlier failed lookup. Wait up to 30 minutes, or clear the DNS cache. On macOS, run `sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder`.
Cloudflare shows error 502 or 1033	The tunnel cannot reach VC. Make sure VC is running and that the route’s URL uses the port VC shows.
A Cloudflare 404 page	The request did not match a route. Leave Path empty.
Settings says the token is not a Cloudflare Tunnel token	Copy only the token from the install command, not the whole command.
Settings shows that the relay client is not installed	Choose Change and save again, then allow the download. Without internet access, install `cloudflared` yourself and make sure it is on the host’s `PATH`.