Remote Access to LedgerCrossing with a Cloudflare Tunnel

LedgerCrossing is local-first: out of the box it listens only on the QuickBooks machine, and nothing about your books is reachable from the internet. But plenty of real integrations live somewhere else — a cloud app you wrote, a script on another site, a VPS that batches orders overnight. This guide is the recommended way to let those systems reach LedgerCrossing without opening a single firewall port: a Cloudflare Tunnel running on your own free Cloudflare account, so TLS and access control sit at your edge and you keep full control.

Prefer zero setup? LedgerCrossing Remote is the built-in managed relay — flip it on, get a secure endpoint, done ($39/mo, cancel anytime, 30-day money-back guarantee). This guide is the free, self-managed path for people who like owning their infrastructure.

Before you start (non-negotiable)

1. Update LedgerCrossing to v1.2.0 or later. From that version, an API key is generated on first run and on by default, and connections from other machines are refused unless a key is set — this guide assumes that behavior.
2. You need a free Cloudflare account with a domain you own added to it (Cloudflare Tunnel endpoints are hostnames on your domain). Any cheap domain works; it does not have to be your business's main domain.
3. Decide which machine: the tunnel runs on the same Windows machine as LedgerCrossing and QuickBooks.

Step 1 — Turn on remote connections in LedgerCrossing

1. Right-click the LedgerCrossing tray icon → Settings.
2. Under Security, copy the API key (auto-generated on first run; treat it like a password — it's stored encrypted on the machine). Clients send it in the X-Api-Key header (or Authorization: Bearer <key>).
3. Check "Allow connections from other machines on the network".
4. Note the local endpoint: http://localhost:8284 by default (the port is shown in Settings if you've changed it). Leave the built-in HTTPS option off for this setup — the tunnel connects on this machine over loopback, and traffic beyond it rides Cloudflare's TLS. (The self-signed HTTPS option is for LAN/VPN setups without a tunnel.)

Step 2 — Create the tunnel (Cloudflare dashboard, ~10 minutes)

1. In the Cloudflare dashboard: Zero Trust → Networks → Tunnels → Create a tunnel (Cloudflared type).
2. Name it (e.g. ledgercrossing-officeserver) and follow the Windows install command shown — it installs cloudflared as a Windows service with your tunnel token, so it survives reboots.
3. Add a Public Hostname: pick a subdomain (e.g. qb.yourdomain.com), service type HTTP, URL localhost:8284.
4. Done: https://qb.yourdomain.com now reaches LedgerCrossing over an outbound-only connection — no port-forwarding, no inbound firewall rule, TLS terminated at Cloudflare's edge.

Step 3 — Lock it down (do not skip)

The API key alone should never be your only lock on an internet-reachable accounting endpoint. Layer at least one of these — both are free:

• Cloudflare Access service token (recommended): Zero Trust → Access → create an Application for qb.yourdomain.com, add a Service Auth policy, and create a service token. Your client then sends the CF-Access-Client-Id/CF-Access-Client-Secret headers with every request. Anything without the token is rejected at Cloudflare's edge — it never touches your machine.
• WAF/IP allowlist: if your remote caller has a stable IP, add a WAF rule allowing only that IP to the hostname. (LedgerCrossing also has its own IP allowlist under Settings → Security — belt and suspenders if you want a second layer on the machine itself.)

LedgerCrossing adds its own backstop either way: repeated wrong-key attempts are rate-limited (HTTP 429) and every rejected request lands in an audit log next to the regular logs.

Then send your qbXML exactly as you do locally — POST to https://qb.yourdomain.com/... with your X-Api-Key header plus the Access token headers.

Long-running requests (read this if syncs are big or QuickBooks isn't already open)

Some QuickBooks operations are slow — first connection while QuickBooks launches, giant reports, big batch writes. Proxied requests through Cloudflare's free tier time out at roughly 100 seconds, which a cold QuickBooks launch can exceed.

Practical rules that avoid the problem for most setups:

1. Set up the machine per the unattended server guide so QuickBooks is always open — cold-launch delays disappear.
2. Send a small warm-up request (e.g. a HostQuery) before your first real batch of the day.
3. Break very large syncs into smaller qbXML requests — good practice locally, essential remotely.

If your workload genuinely needs single requests longer than the free tier allows, that's the case LedgerCrossing Remote is engineered for — its relay is verified with 120+ second requests.

Alternatives to a Cloudflare Tunnel

• Tailscale / WireGuard VPN — great when the remote caller is a machine you control; your endpoint is never public at all. Requires installing the VPN on both ends.
• Your existing VPN or reverse proxy — if the office already has one, use it; LedgerCrossing is just an HTTP service behind it.
• Plain port-forwarding — don't. Exposing the raw port to the internet with only an API key is exactly the setup this guide exists to prevent.

FAQ

Does my accounting data pass through Cloudflare? Request/response traffic transits Cloudflare's edge encrypted on your own account, under your control — that's the trade for free, zero-port-forward access. If nothing may leave the building, use the VPN option or stay local-only.

Does this cost anything? No — Cloudflare's free plan covers tunnels, Access service tokens, and WAF rules at this scale. Your only cost is a domain.

What about the Web Connector? It never needed any of this because it only made outbound calls — and it also crashed daily. This setup keeps the outbound-only property (the tunnel dials out) while giving you a real API.

QuickBooks is a registered trademark of Intuit Inc. LedgerCrossing is an independent product for QuickBooks Desktop and is not affiliated with or endorsed by Intuit. Cloudflare is a trademark of Cloudflare, Inc.; LedgerCrossing is not affiliated with Cloudflare — this guide configures your own Cloudflare account.