have a look at the guide on the template overview -

Yes, I have already gotten that setup.

But even with that the URL is publicly accessible with the tunnel attached to a sub-domain.

Cloudflare has this another feature called Zero trust Access.
Where it allows more fine grain control over the access.

I was hoping to make that work with private service deployed on railway.

if you followed the guide you would be using the private network already?

When you say "private network", do you mean making the service private without any domain name attached to it?

Then yes.

then im not quite understanding the issue?

In the cf-tunnel railway template, it says

Click Public Hostname → Click Add a public hostname.

For example: I have a domain example.com
and I add a sub-domain by connecting it to private service on railway.
like pvt-srv.example.com

now, even this sub-domain is publicly accessible, abit in-directly via tunnel from cloudflare.

what I was looking for is that I wanted to limit access the url/domain itself.
as to who can access it

that would need to be done in cloudflare