Cloudflare Quick Tunnel --allowed-mail: do Sume webhooks get through?

Probably not. Cloudflare's October 2 change lets you add --allowed-mail to a Quick Tunnel so that visitors must sign in with a one-time PIN sent to their email. Sume's run webhook is a machine-to-machine POST with no inbox to read that PIN from, so a gated tunnel is the wrong receiver for it. Use a plain Quick Tunnel for the test and let the HMAC signature do the gatekeeping. This is reasoning from the two documented behaviours, not a measured test against a gated tunnel.

What each side documents

A test setup that works

Because Sume rejects localhost, the tunnel is useful: it gives your local receiver a public HTTPS name. Start it without --allowed-mail, pass the tunnel URL as communication.webhook_url on an Agent Completion, and reject any request whose signature fails. The signature scheme is HMAC-SHA256 over <timestamp>.<raw_body> with the secret in SUME_COM_WEBHOOK_SIGNING_SECRET, sent as x-sume-webhook-signature: sume-v1=<hex>. The script below refuses to run without a secret and checks the five-minute replay window.

Cloudflare lists three ways to write the flag: a single address, repeated or comma-separated addresses, and a whole domain. None of them help an automated sender, which is the point. A webhook caller should never be asked to prove an identity by email; it proves itself with the signed headers. Keep the tunnel command and the verifier together in your repo's dev notes so the next person does not turn the email gate on and then wonder why deliveries stop.

import hashlib, hmac, os, sys, time
secret = os.environ.get("SUME_COM_WEBHOOK_SIGNING_SECRET", "")
if not secret:
    sys.exit("set SUME_COM_WEBHOOK_SIGNING_SECRET first")

def verify(ts: str, raw: bytes, header: str) -> bool:
    if abs(time.time() - int(ts)) > 300:
        return False
    mac = hmac.new(secret.encode(), ts.encode() + b"." + raw, hashlib.sha256)
    return hmac.compare_digest(header, "sume-v1=" + mac.hexdigest())

ts = str(int(time.time()))
raw = b'{"event":"agent.run.terminal","outcome":"ok"}'
good = "sume-v1=" + hmac.new(secret.encode(), ts.encode() + b"." + raw, hashlib.sha256).hexdigest()
print(verify(ts, raw, good), verify(ts, raw, "sume-v1=bad"))

Keep the gate for people, not callers

Cloudflare says the email gate is meant for sharing dev servers, webhooks or demos with people who need to look at them, and that access ends when cloudflared stops. That fits a teammate previewing your receiver's dashboard. For the Sume side, keep a second route open and verify signatures on it, or skip the tunnel and poll the run's status_url until next_action is no longer poll_status. A failed delivery never changes the run: it stays completed, and result_url still returns the receipt.