···4646 TAP_ADMIN_PASSWORD=
4747 ```
48484949-4. configure the public-facing URL:
4949+4. set up a tunnel:
5050+5151+ confidential OAuth clients requires a publicly accessible URL. for local development, you'll need
5252+ to tunnel your local server using a service like [ngrok](https://ngrok.com/) or
5353+ [cloudflared](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do
5454+ wnloads/).
5555+5656+ once running, set the tunnel URL as your public URL in `.env`:
50575158 ```sh
5252- OAUTH_PUBLIC_URL=https://insulation-famous-bluetooth-secret.trycloudflare.com
5959+ OAUTH_PUBLIC_URL=https://your-tunnel-url.example.com
5360 ```
546155625. migrate the database: