| Tier | Bytes (rolling 7 days) | Session time (rolling 24 h) |
|---|---|---|
| Anonymous | 1 GiB | 30 min |
| Free account | 5 GiB | 2 h |
Example
Flags
| Flag | Default | Purpose |
|---|---|---|
--email | (prompt) | Skip the prompt - useful in scripts. |
What happens
- CLI prompts for your email (or accepts
--email). - POSTs
/v1/accounts/signupwith the address. - The server sends a magic link to your inbox.
- You open the link. The verify page shows a “Confirm and upgrade” button - one extra click before the token is consumed. (This protects you against Slack / iMessage / Outlook Safe Links previews silently burning the one-shot token before you click.)
- The POST behind the button consumes the link and binds your email to the device-bound install token you already had as an anonymous user.
- Next
tunnelbyteinvocation uses the upgraded token automatically.
Why no password
Email is identity. The magic link is the auth factor. Each device gets its own token derived from your install fingerprint - links don’t replay across devices, and there’s no password to leak or rotate. If you want this account on a second machine, installtunnelbyte there and run tunnelbyte login.
Notes
- We don’t verify phone numbers, ask for KYC documents, or run identity checks. The whole flow is sub-30 seconds.
- Disposable email domains get rejected at signup. Use a real address.
- One account per email. Re-running
signupwith the same address sends a fresh magic link to the same account; it doesn’t create a duplicate.
See also
tunnelbyte login- link a second device.- Tiers - what free vs paid gets you.