Tunnels: Tailscale & Cloudflare
Reach your agent over your own network — privately through your Tailscale tailnet, or publicly on your own domain through a Cloudflare Tunnel.
Every agent gets a https://<name>.sokko.ai address protected by your Sokko
login. Tunnels add a second way in, on your network instead of ours:
- Tailscale — the agent joins your tailnet as a device. You (and only people on your tailnet) can reach it privately, from anywhere, with no public exposure at all. This is the option we recommend.
- Cloudflare Tunnel — the agent is published on a domain you manage in
Cloudflare, like
https://agent.yourcompany.com.
Both live in the Networking tab on the agent's page, work for OpenClaw, Hermes, and Paperclip, and are included on every paid plan. Connecting or disconnecting redeploys the agent, which takes about a minute.
One thing to understand first
Traffic that arrives through a tunnel does not pass your Sokko login. That is the point — it is your network — but it means access is controlled by your side:
- On Tailscale, anyone on your tailnet can reach the agent (including its
terminal at
/terminal). Use tailnet ACLs if you want to narrow that. - On Cloudflare, a public hostname with no protection is open to the whole internet. Put Cloudflare Access in front — the automatic setup below can do this for you and allow-lists your team.
The dashboard shows a warning on any Cloudflare hostname that has no Access policy. Don't ignore it.
Tailscale
The quick way: connect your Tailscale account once
Create a tag and an OAuth client
In your tailnet's policy file, add a
tag for Sokko agents (for example tag:sokko) under tagOwners. Then, on the
Trust credentials
page, create an OAuth client with the Auth keys write scope and that
tag. Keep the tag least-privileged in your ACLs — the key ends up readable
from the agent's own shell.
Paste it into Sokko
In Settings → Infrastructure connections, paste the client ID, client secret, and tag. This is a one-time, organization-wide step.
Set up the agent in one click
On the agent's Networking tab, click Set up automatically. Sokko mints a fresh, tagged key from your Tailscale account and the agent joins your tailnet — no checkboxes to get right. A Mint fresh key button rotates it whenever you like.
The manual way
Create an auth key yourself at Settings → Keys — make it reusable, ephemeral, pre-approved, and tagged — and paste it into the agent's Networking tab.
Turn on HTTPS for your tailnet (one-time)
The agent's https://….ts.net address needs two Tailscale features that are
off by default: MagicDNS and HTTPS Certificates. Both live on the
DNS page of your admin console —
most tailnets already have MagicDNS on; scroll down and enable HTTPS
Certificates too. Without it the agent joins your tailnet fine, but its
https:// address refuses connections because no certificate can be issued.
Reaching the agent
The agent appears in your tailnet named after its Sokko address (for example
agent-research-bot). Open https://agent-research-bot.<your-tailnet>.ts.net
for the agent's interface, or /terminal on the same address for its
terminal. If the agent's machine restarts, it may take a minute to rejoin, and
Tailscale can briefly show the old device alongside the new one — the old one
cleans itself up in under an hour. If you redeploy while the old device is
still listed, the new one takes a -1 name (like agent-research-bot-1);
delete the offline duplicate in your Machines page and redeploy to get the
clean name back.
Cloudflare Tunnel
The quick way: connect your Cloudflare account once
Connect
In Settings → Infrastructure connections, click Connect Cloudflare account. You'll land on Cloudflare's consent screen, pick which account to share, and come straight back.
Create the tunnel in one click
On the agent's Networking tab, pick the domain and subdomain you want
(say agent.yourcompany.com), leave Protect with Cloudflare Access
checked, and click Create tunnel. Sokko creates the tunnel, the DNS
record, and an Access policy that only lets your team in.
Open your new address
https://agent.yourcompany.com now reaches your agent. Team members sign in
through Cloudflare Access the first time.
If your Cloudflare account has never used Zero Trust, the Access step can't be completed automatically — the tunnel still works, but the hostname is public until you add an Access policy in your Cloudflare dashboard. Sokko warns you loudly when this happens.
Disconnecting from the Networking tab also removes the tunnel, DNS record, and Access app from your Cloudflare account.
The manual way
Create a tunnel yourself in
Zero Trust → Networks → Tunnels, copy its
token, and paste it into the agent's Networking tab. Then add a public
hostname in Cloudflare pointing at the http://localhost:<port> address the
dashboard shows you.
Good to know
- Your Tailscale and Cloudflare credentials are stored encrypted in Sokko's vault. The organization-level credentials never reach the agent's machine; only the per-agent key or tunnel token does.
- Tunnels don't replace the
sokko.aiaddress — both work at the same time. - Removing a tunnel is instant and safe: disconnect from the Networking tab and the agent redeploys without it.