Yes, you can configure a Cloudflare Tunnel public hostname to require
authentication via Google accounts using Cloudflare Access (part of Cloudflare
Zero Trust). Cloudflare intercepts the incoming web traffic and presents a
secure login screen; the request is only routed through your cloudflared
tunnel if the user successfully authenticates.
Here is how to configure it:
 1. Add Google as an Identity Provider
   Zero Trust Dashboard & Google Cloud Console
   You first need to link Google to Cloudflare. In the Cloudflare Zero Trust
dashboard, navigate to Integrations > Identity providers and select Add new
identity provider choosing Google. You will need to supply an OAuth Client ID
and Client Secret, which you must generate from the Google Cloud Platform
console by creating a Web Application OAuth client.
   Verification: Once saved, click Test next to the Google provider in your
Cloudflare dashboard. A successful test will redirect you to a Google login
page and return a success message.
 2. Create a Self-Hosted Application
   Zero Trust Dashboard
   Navigate to Access > Applications and click Add an Application. Choose
Self-hosted as the application type. Fill in the application name and enter
your exact tunnel public hostname (e.g., cluster.omega-mesh.org) in the
application URL fields.
   Verification: The application will appear in your Access Applications list
once you proceed to the next page.
 3. Define an Access Policy
   Rule Configuration
   In the policy step of the application creation, define who is allowed to
authenticate. Create a policy with the Action set to Allow. Under the Include
rule type, select your criteriasuch as specific individual emails, an entire
Email domain (like a Google Workspace domain), or an Everyone rule if you plan
to rely entirely on Google's own authentication restrictions.
   Verification: Review the policy summary to ensure the allowed list
accurately reflects the subset of Google accounts you want to grant access to.
 4. Assign the Login Method
   Authentication Tab
   Before saving the application, navigate to the Authentication tab. Under
Login methods, ensure that your newly created Google identity provider is
toggled on. You can uncheck other default methods like the one-time PIN (OTP)
if you strictly want Google OAuth.
   Verification: Save the application. Open an incognito browser window and
navigate to [https://cluster.omega-mesh.org](https://cluster.omega-mesh.org).
You should immediately be intercepted by a Cloudflare Access screen asking you
to log in with Google.