Travis Calvert

Posted on Oct 20

How to Automatically Start a Cloudflare Tunnel When You Sign In to Windows

#cloudflare #windows #powershell #tutorial

If you use Cloudflare Tunnel to expose a local development server, self-hosted application, or internal dashboard, you've probably encountered this problem:

Everything works until you restart Windows.

Your application might still be running, but the Cloudflare Tunnel process isn't. Suddenly, your public hostname is unreachable until you manually launch cloudflared again.

Here's how to automate that process using Windows Task Scheduler.

The problem

A typical Cloudflare Tunnel setup uses a command like:

cloudflared.exe tunnel run --token YOUR_TUNNEL_TOKEN

That works perfectly well in an interactive terminal.

But closing the terminal, signing out, or restarting Windows stops the process.

You can solve this by configuring Windows to launch the tunnel automatically when you sign in.

Step 1: Create a startup script

Create a PowerShell script named Start-Tunnel.ps1.

For example:

$cloudflared = "C:\Tools\cloudflared.exe"
$tokenFile = "$env:LOCALAPPDATA\CloudflareTunnel\token.txt"

if (-not (Test-Path -LiteralPath $cloudflared)) {
    throw "cloudflared.exe was not found."
}

if (-not (Test-Path -LiteralPath $tokenFile)) {
    throw "Tunnel token file was not found."
}

$token = (Get-Content -LiteralPath $tokenFile -Raw).Trim()

if ([string]::IsNullOrWhiteSpace($token)) {
    throw "Tunnel token is empty."
}

& $cloudflared tunnel run --token $token

Update the executable path to match your installation.

The script reads the tunnel token from a separate local file instead of embedding it directly in the script.

Security note: Your tunnel token is a credential. Don't commit it to GitHub, include it in screenshots, or share it in support requests. Restrict access to the token file to your Windows account.

Step 2: Configure Windows Task Scheduler

Open Task Scheduler and select Create Task.

Under General:

Give the task a descriptive name, such as Cloudflare Tunnel Startup.
Select Run only when user is logged on.
Use your normal Windows account.

Under Triggers:

Create a trigger that runs At log on.
Select your Windows account.

Under Actions, create a new action:

Program/script:

powershell.exe

Add arguments:

-NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Scripts\Start-Tunnel.ps1"

Replace the script path with your actual location.

Under Settings, review the options that control whether the task can start again while an existing instance is running.

Save the task.

Step 3: Test it

Right-click the task and select Run.

Check Task Manager for the cloudflared.exe process.

Then verify that your public hostname actually reaches your local application.

A running process alone doesn't prove the tunnel is connected successfully.

Finally, sign out and sign back in to confirm that the task launches automatically.

What about running the tunnel before login?

A sign-in task starts only after the specified user logs on.

If you need the tunnel to be available immediately after Windows boots, before anyone signs in, you'll need a different approach, such as a properly configured Windows service.

That distinction matters for unattended servers.

Where this basic approach gets complicated

Task Scheduler handles the initial launch, but a production-quality setup involves more than just running a PowerShell script.

You may also want:

Protection against duplicate launchers
A predictable way to stop the tunnel
Logging for troubleshooting
Secure token storage
Clean installation and removal
Reliable cleanup of child processes

These details can take longer to get right than the initial scheduled task.

A ready-made alternative

I built Cloudflare Tunnel Auto-Start Kit for Windows under Blacktop Logic to package the Windows sign-in approach into a reusable toolkit.

It includes PowerShell installation, startup, status, and uninstall scripts, along with process management and logging.

It is designed for user sign-in startup, not as a replacement for a Windows service.

The kit is available as a one-time $19 purchase:

https://payhip.com/b/FnwaJ

If you're comfortable maintaining your own scheduled task, the manual approach above may be all you need.

If you'd rather avoid building and troubleshooting the supporting scripts yourself, the kit is another option.

Published by Blacktop Logic — practical software utilities for developers and self-hosters.

DEV Community