Turn Your Own Machine Into a Public API Server (For Free) Using Cloudflare Tunnel

Recently, I wanted to use my own machine as a server. Not for production, just experimenting. Testing an API. Saving cloud costs. Trying out a few AI endpoints.

I expected this to be complicated: VPNs, port forwarding, firewalls, all the usual pain. So I researched a bunch of solutions. And surprisingly, the cleanest, fastest, most secure option was 👉 Cloudflare Tunnel.

It's free. It's easy. And it works beautifully. Sharing the exact steps I used in case someone else needs this.

cloudflared connects out to Cloudflare, so your router and firewall stay closed.

Step 1: Install cloudflared

brew install cloudflared

Log in:

cloudflared tunnel login

This connects your Cloudflare account.

Step 2: Create a Tunnel

cloudflared tunnel create my-tunnel

Cloudflare will generate:

• a tunnel ID
• a credentials JSON file

This authenticates your machine.

Step 3: (Optional) Map a Domain / Subdomain

If you want a custom URL:

cloudflared tunnel route dns my-tunnel api.yourwebsite.com

No domain? For quick tests, cloudflared tunnel --url http://localhost:8000 gives you a temporary trycloudflare.com address instead.

Step 4: Configure the Tunnel

Create:

~/.cloudflared/config.yml

Add:

tunnel: <your-tunnel-id>
credentials-file: <path-to-credentials.json>

ingress:
  - hostname: api.example.com
    service: http://localhost:8000
  - service: http_status:404

This means: public URL → tunnel → your local FastAPI server.

Step 5: Run the Tunnel

cloudflared tunnel run my-tunnel

That's it! Your local API is now securely exposed to the internet. No port forwarding. No firewall changes. No server deployment.

Congrats! Your machine is now acting as a secure public API server, without any deployment or port forwarding. Feels like magic the first time you see it work.

Optional: Keep It Running Automatically

On macOS you can use launchctl to keep the tunnel alive:

launchctl load ~/Library/LaunchAgents/com.tunnel.plist
launchctl start com.tunnel
launchctl stop com.tunnel
launchctl unload ~/Library/LaunchAgents/com.tunnel.plist

🎯 Why This Is Useful

• Test APIs without deploying
• Run local AI inference endpoints
• Prototype backend changes instantly
• Webhook testing
• Connect a frontend to a local backend
• Experiment without cloud costs

Once you try this, you realize how powerful "local → public" can be.

If the API behind your tunnel is a chatbot that answers from documents, here is why it may give wrong answers and how to fix it. More notes like this one are in engineering notes.

Common questions

Is Cloudflare Tunnel free?
Yes. Cloudflare Tunnel is free to use with a Cloudflare account, which is what makes it a good fit for testing APIs and running small projects from your own machine.

Do I need to open ports or change my firewall?
No. cloudflared makes an outbound connection from your machine to Cloudflare, so nothing has to be forwarded on your router and no inbound firewall rule is needed.

Do I need my own domain to use Cloudflare Tunnel?
Not for testing. Running cloudflared tunnel --url http://localhost:8000 gives you a temporary trycloudflare.com address. For a stable address, route the tunnel to a hostname on a domain in your Cloudflare account.

Is it safe to expose my local machine this way?
Only the services listed in the ingress rules are reachable, and visitors connect to Cloudflare rather than to your IP address. If the API should not be public, put Cloudflare Access in front of the hostname so only approved users get through.

---

This post first appeared on tusharbhendarkar.com. I write about the engineering behind what I ship. If something here is broken for you, email me at [e-mail].