Task-oriented snippets for the tunnel CLI. Each snippet does one thing.
Env vars below use the TUNNEL_ prefix. The CLI also reads the old RNP_ name of each variable.

​
Expose a local web app at a public URL

This is the headline move. Save an API key one time. Then one command gives you a public HTTPS URL with no inbound port.

​
Reserve a stable subdomain

Add the subdomain one time. Then give it to http with --url.

​
Use your own hostname

Add the hostname on the Domains page of the Tunnel console, or with tunnel domains add. Create the DNS record that it shows. Then:

​
Run more than one tunnel

Give each service its own domain, so each service gets its own URL.

​
Receive a webhook on your laptop

Point the provider’s webhook at your public URL. Deliveries reach localhost without a deployed server.
Streaming and chunked responses (SSE, long-poll) pass through unchanged. Each public connection is its own QUIC stream, so one slow request never blocks others.

​
Tunnel a raw-TCP service (SSH, Postgres)

The raw-TCP type maps a remote endpoint to a local port with no HTTP parsing. It is a good fit for SSH or a database. Use the P2P direct form for a private link. Use the public form for an internet-reachable port.

​
Point a remote shell at a box behind NAT

Use the same P2P flow for SSH. The box only dials out. No inbound rule is necessary.

​
Connect two boxes on the same LAN

On one subnet, discovery is automatic. The edge stays fully out of the path.

​
Punch through NATs with STUN

Across networks, set a STUN reflector so each side gathers its public candidate before punching.
Cone NATs punch directly. Symmetric NATs fall back to the relayed path automatically.

​
Pick a region / specific edge PoP

Override the edge that the data plane dials, for example to test a region or a self-hosted PoP.

​
Point at a self-hosted control plane

To run against your own control plane, override the API base.

​
Check the key, hosts, and egress

See the organization, the key, its hosts, and the egress for this month. This command uses the key. It does not need a sign-in.

​
Revoke the key of an old machine

Use one key for each machine. Then one revoke removes one machine.

​
Use a custom engine binary

If the QUIC data-plane engine is not next to the CLI, point at it explicitly.

​
Enable remote desktop over the QUIC relay

QuickDesk uses this relay for transport instead of its own rendezvous/relay. Point it at the relay in its network settings:
The controlled box registers its device id as a slug and parks streams. The controller dials it by slug. QuickDesk’s own end-to-end encryption is unchanged. See the QuickDesk docs for the full product.

​
Run as a long-lived background tunnel

http runs in the foreground until you interrupt it. tunnel service install runs the named tunnels of the config file at login (Linux and macOS). You can also use your own process manager.