diff --git a/cmd/flipt/main.go b/cmd/flipt/main.go
index ba6d425543..dbdaa9a772 100644
--- a/cmd/flipt/main.go
+++ b/cmd/flipt/main.go
@@ -374,18 +374,19 @@ func run(ctx context.Context, logger *zap.Logger, cfg *config.Config) error {
 		tunnel := fmt.Sprintf("%s-%s.%s", cfg.Server.Cloud.Instance, cfg.Server.Cloud.Organization, cfg.Server.Cloud.Address)
 
 		tunnelServer := &client.Server{
-			TunnelGroup: tunnel,
-			Handler:     httpServer.Handler,
+			TunnelGroup:   tunnel,
+			Handler:       httpServer.Handler,
+			Authenticator: client.BearerAuthenticator(cfg.Server.Cloud.Authentication.ApiKey),
 		}
 
 		// starts QUIC tunnel server to connect to Cloud
 		g.Go(func() error {
 			defer tunnelServer.Close()
 
-			logger.Info("tunnel available", zap.String("address", tunnel), zap.Int("port", cfg.Server.Cloud.Port))
+			logger.Info("cloud tunnel available", zap.String("address", tunnel), zap.Int("port", cfg.Server.Cloud.Port))
 
 			if err := tunnelServer.DialAndServe(ctx, fmt.Sprintf("%s:%d", tunnel, cfg.Server.Cloud.Port)); !errors.Is(err, http.ErrServerClosed) {
-				return fmt.Errorf("tunnel server: %w", err)
+				return fmt.Errorf("cloud tunnel server: %w", err)
 			}
 
 			return nil