Temporarily Share Your Local ARI Online
If you are running ARI on your local computer, sometimes you may want to reach it from somewhere else to open your dashboard on your phone from a coffee shop, or to let a teammate access ARI on your computer. ARI lets you temporarily create a public URL which links to your ARI installation. It is free, fast, encrypted and powered by Cloudflare Tunnels. No account required.
ARI is integrated with Cloudflare Quick Tunnel. When enabled, you get a random public address like https://[name].trycloudflare.com that works from any network. Traffic is encrypted end to end, no ports are opened on your router, and the tunnel disappears the moment you stop ARI.
Quick Tunnels are free and need no Cloudflare account.
Before you share: a tunnel makes the ARI running on your computer reachable by anyone who has the address — they will land on your sign-in page, so a strong password is important. The address only lives as long as ARI does: the moment you stop ARI, the tunnel disappears and the link stops working.
That makes tunnels perfect for a quick demo or a day on the road, but not for keeping ARI online. If you want ARI available all the time, host it on a service like Vercel instead — see Installing ARI on Vercel.
Starting a Tunnel
./ari start --tunnel
When ARI is ready you will see the public address next to the local one:
✔ ARI is running
- Local: http://localhost:3000
- Tunnel: https://[name].trycloudflare.com
Anyone with this URL can reach ARI's sign-in page. It is temporary and changes every restart.
Press Ctrl+C to stop ARI.
Open the tunnel address on any device and sign in with your normal ARI credentials. The local address keeps working at the same time. The tunnel can take up to thirty seconds to become reachable after it is printed.
Press Ctrl+C to stop ARI. The tunnel closes with it, and the address stops working immediately.
The --tunnel flag can be used with other start flags:
| Command | Effect |
|---|---|
./ari start --tunnel --verbose | Also streams the dev server and cloudflared logs |
./ari start --tunnel --lan | Also binds to your local network, so devices on your Wi-Fi can use the Network: address |
PORT=3001 ./ari start --tunnel | Runs ARI on a different port (the tunnel needs a fixed port, so ARI will not fall back to another one automatically) |
Troubleshooting
| Message | What to do |
|---|---|
cloudflared is not installed | When you run the ARI installer, it asks if you would like to also install cloudflared. If it is not installed, follow Cloudflare's installation guide. Then open a new terminal and try again. |
Finish ARI setup locally first | Run ./ari start without the flag, complete the wizard at http://localhost:3000, and sign in once. |
Port 3000 is already in use | Stop whatever is using the port (often a previous ARI still running), or start with PORT=3001 ./ari start --tunnel. |
Could not start the Cloudflare tunnel | Your network is blocking cloudflared's outbound connection (UDP port 7844, with a fallback to TCP 443). Try again, try another network, or start with ARI_TUNNEL_PROTOCOL=http2 ./ari start --tunnel, which skips the UDP transport. |
Cloudflare tunnel disconnected | The connector lost its link to Cloudflare. ARI keeps running locally; press Ctrl+C and start again for a fresh address. |
| 403 or 401 on sign-in | You started cloudflared yourself instead of with --tunnel, so ARI does not trust the address. Stop it and use ./ari start --tunnel. |
| No live reload | Same cause as above — live reload is only allowed from addresses ARI was started with. |
How It Works
cloudflared opens an outbound connection to Cloudflare's network and forwards everything that arrives at your public address to http://localhost:3000. Because the connection is outbound, nothing needs to be opened or forwarded on your router or firewall.
ARI validates the origin of every sign-in and API request as a defence against cross-site attacks. The CLI passes the tunnel address to ARI for the lifetime of that one session (as ARI_TUNNEL_ORIGIN) so that sign-in, live reload, and every module work through it. Nothing is written to .env.local, nothing is stored, and your BETTER_AUTH_URL is untouched — the next plain ./ari start is exactly as it was before.
This is also why running cloudflared by hand does not work: ARI will reject sign-in from an origin it was not told about.
ARI refuses to open a tunnel until your installation is configured and the first admin account exists. If you have just installed ARI, run ./ari start once, complete the Welcome Setup Wizard at http://localhost:3000, and sign in. Then start again with --tunnel.
This is deliberate: the setup wizard is the one part of ARI that has no password in front of it, and it should never be reachable from the public internet.
Security
- Anyone with the address reaches your sign-in page. Your password is the perimeter. ARI requires at least 18 characters, rate-limits sign-in attempts, and supports two-factor authentication under Settings → Security — turn it on before you share a tunnel.
- Treat the address like a password. Send it privately, and only to people you would let sign in.
- It is temporary by design. Every restart produces a new address, so an old link cannot be reused later.
- Setup mode is never exposed. The CLI checks that your installation is configured and has an admin account before it opens anything.
- Quick Tunnels are for sharing, not hosting. Cloudflare offers no uptime guarantee for them and caps them at around 200 simultaneous requests. For a permanent address on your own domain, see named Cloudflare Tunnels.
Two limits worth knowing. Integrations that need an absolute callback address, such as Google sign-in for the Today's Brief module, still use your local address and only work from your own machine. And because all tunnel visitors arrive through Cloudflare, they share one rate-limit bucket — a burst of failed sign-ins from one person briefly slows everyone on the tunnel, which is the safe direction to fail.
Related
- Commands — every
./aricommand and flag - Security — how ARI protects your data
- Installation — the installer and what it sets up