Cloudflare Tunnel can be authenticated via other means like JWT, but that is definitely a non-starter since the apps don't support it. Tailscale would definitely be better.

I haven't tried it with Cloudflare specifically, but I believe you should be able to just put the domain name in as the server address in the mobile and TV apps.

I'm not sure why it wouldn't work with the apps? I have my jellyfin server behind a CF tunnel and I can access it in the Android app by my domain.

Oh I see. I confused Cloudflare Tunnel with Cloudflare Access.

Yes Cloudflare Tunnel can work with Jellyfin apps, but: 1) this exposed your Jellyfin to the world, and you are one vulnerable away to get owned, and 2) like other sibling posts mentioned, this is against their ToS to host streaming service on free plan on their platform.

I though Cloudflare forbade streaming via their network? Did their ToS change?