Share URLs Core

Every tunnel automatically gets a human-readable share URL like swift-bay.nfltr.xyz. Share it with anyone — no sign-up required to access. Add password protection, IP restrictions, or bearer token authentication with a single flag.

How Share URLs Work

When you start a tunnel, the NFLTR server generates a memorable two-word subdomain and routes it to your agent. The share URL is a wildcard DNS entry — *.nfltr.xyz — so it works instantly with zero DNS configuration.

Basic Usage

Share URLs are generated automatically — just run nfltr http:

$ nfltr http 3000
Share URL: https://swift-bay.nfltr.xyz/

Send the URL to anyone. They can access your local service immediately — no NFLTR account needed.

To disable share URL generation:

nfltr http 3000 --no-share

Protection Options

Share URLs can be protected in multiple ways — all configurable from the command line:

🔑 Password Protection

Visitors must enter a username and password before accessing the share URL.

nfltr http 3000 \
  --share-auth user:password

🌐 IP Allowlist

Restrict access to specific IP addresses or CIDR ranges.

nfltr http 3000 \
  --share-ip-allowlist 1.2.3.4 \
  --share-ip-allowlist 10.0.0.0/8

🎟️ Bearer Token

Require an Authorization: Bearer header for programmatic access.

nfltr http 3000 \
  --share-bearer mytoken123

# Access with:
curl -H "Authorization: Bearer mytoken123" \
  https://swift-bay.nfltr.xyz/

URL Formats

NFLTR provides two types of URLs for each tunnel:

Type	URL Pattern	Persistence	Authentication
Share URL	`https://swift-bay.nfltr.xyz/`	Changes on each tunnel start (ephemeral)	Public (no auth needed)
Browse URL	`https://nfltr.xyz/browse/alice.my-api/`	Stable — uses your agent ID (persistent)	Requires API key or dashboard session

Use share URLs for temporary access (demos, reviews, testing, webhook callbacks). Use browse URLs with --name for stable, long-lived endpoints where you control the requester’s authentication.

Auto-Expiry

Share URLs expire automatically when the agent disconnects. This ensures that temporary links don't linger after you stop your tunnel. When the agent reconnects, a new share code is generated.

💡 Combine protections

You can use multiple protection mechanisms together. For example, --share-auth + --share-ip-allowlist requires both password and correct IP address.

Use Cases

Code review — Share your local branch with a teammate: "check out swift-bay.nfltr.xyz"
Client demos — Show work-in-progress to clients without deploying to staging
Pair programming — Let a colleague interact with your running app in real time
QA testing — QA team accesses your local build via the share URL
Media sharing — Share your Jellyfin library with friends via a simple link

Start sharing in seconds

One command gives you a public, shareable URL for any local service.

Download Agent HTTP Tunnels →