diff --git a/src/commands/devbox/create.ts b/src/commands/devbox/create.ts
index f626b90a..ff6b2bc2 100644
--- a/src/commands/devbox/create.ts
+++ b/src/commands/devbox/create.ts
@@ -23,6 +23,7 @@ interface CreateOptions {
   root?: boolean;
   user?: string;
   networkPolicy?: string;
+  tunnel?: string;
   gateways?: string[];
   output?: string;
 }
@@ -139,6 +140,13 @@ export async function createDevbox(options: CreateOptions = {}) {
       );
     }
 
+    // Validate tunnel option
+    if (options.tunnel && !["open", "authenticated"].includes(options.tunnel)) {
+      outputError(
+        "Invalid tunnel mode. Must be either 'open' or 'authenticated'",
+      );
+    }
+
     // Build launch parameters
     const launchParameters: Record<string, unknown> = {};
     if (options.resources) {
@@ -213,6 +221,13 @@ export async function createDevbox(options: CreateOptions = {}) {
       createRequest.secrets = parseSecrets(options.secrets);
     }
 
+    // Handle tunnel configuration
+    if (options.tunnel) {
+      createRequest.tunnel = {
+        auth_mode: options.tunnel,
+      };
+    }
+
     // Handle gateways
     if (options.gateways && options.gateways.length > 0) {
       createRequest.gateways = parseGateways(options.gateways);
diff --git a/src/utils/commands.ts b/src/utils/commands.ts
index 0230320a..f3dc0007 100644
--- a/src/utils/commands.ts
+++ b/src/utils/commands.ts
@@ -59,6 +59,10 @@ export function createProgram(): Command {
     .option("--root", "Run as root")
     .option("--user <user:uid>", "Run as this user (format: username:uid)")
     .option("--network-policy <id>", "Network policy ID to apply")
+    .option(
+      "--tunnel <mode>",
+      "Tunnel authentication mode (open, authenticated)",
+    )
     .option(
       "--gateways <gateways...>",
       "Gateway configurations (format: ENV_PREFIX=gateway_id_or_name,secret_id_or_name)",