Product Updates

Introducing Osir Tunnel: A Public HTTPS Link to Your Local Server

2026-09-24 · OSIR Team

Your app runs on localhost:3000. Nobody else can see it. That is usually the right default, and occasionally the whole problem: a client wants to look at the work, a payment provider needs somewhere to send a webhook, or you want to open the thing on an actual phone instead of a narrow browser window.

Osir Tunnel solves that in one command. It is live today at osir.run and free with an OSIR account.

osir tunnel 3000

The command ships in OSIR CLI 1.3.0. If you already have the CLI, update it; if not, grab the binary for Linux, macOS or Windows and run osir auth login once. The step-by-step guide covers the flags and the dev-server settings in more detail.

+------------------------------------------+
|  https://teuta-butrint-k7m2q.osir.run    |
+------------------------------------------+
Forwarding https://teuta-butrint-k7m2q.osir.run -> http://localhost:3000
Anyone with this link can reach your app. Press Ctrl+C to stop.

That address is real HTTPS, with a certificate browsers already trust, and it points at the server on your machine. Send the link to anyone. When you press Ctrl+C, the link stops working and that address never comes back.

One sign-in, no configuration

Sign in once with osir auth login and there is nothing else to configure: no domain to own, no DNS to point, no certificate to obtain. The service picks a random name like teuta-butrint-k7m2q, and the tunnel exists only while the command runs.

Tunnels are tied to an account on purpose. A service that hands out public HTTPS addresses to anyone attracts phishing, and when a report arrives we need to be able to answer it. We record which account opened which address, from which IP, and when. We do not log the people who visit a tunnel link.

What it is good for

• Showing work in progress. Send a client or a colleague a link to the branch you are running right now, without deploying to a staging server first.
• Webhooks. Point Stripe, GitHub or any other provider at the tunnel address and watch the requests arrive in your local debugger, with breakpoints, exactly as they were sent.
• Testing on real devices. Open the link on a phone, on someone else's laptop, or in a browser-testing service. You get a real HTTPS origin, so service workers, geolocation and clipboard access behave as they will in production.
• Talking to an AI agent or an API sandbox that needs to reach a callback URL on a machine that isn't publicly addressable.

How it works

The command opens one outbound connection from your machine to the osir.run edge and keeps it open. Every visitor request travels down that same connection, and the response comes back the same way. Nothing listens on your network, no port is forwarded, and no firewall rule changes.

Requests are passed through as-is rather than rewritten, so keep-alive connections, WebSockets, server-sent events, streaming responses and large uploads all work. Your app sees the public hostname in the Host header, which is usually what you want for absolute links and cookies.

What it is not

We would rather be plain about this than have you find out at an awkward moment.

• Addresses are random and temporary. You cannot choose a name or keep one between runs. Every restart gives a new address; if the connection drops briefly, the client reconnects and keeps the same one.
• It is for testing and demos, not production. There are no guarantees on speed or availability, and each tunnel has a cap on how many visitors it serves at once. If the connection drops the client reconnects and keeps the same address where it can, and during planned maintenance the address is held for 120 seconds, so a link you have already shared survives a short interruption.
• Anyone with the link can reach your app. There is no password in front of it. Only expose what you mean to share, and stop the command when you are done.
• Abuse gets shut down. Tunnels used for phishing, malware or similar are closed without notice, and the account that opened them answers for it. If you receive a suspicious osir.run link, report it to abuse@osir.com.

Why we built it

We register domains, run DNS and rent servers, and every one of those jobs eventually involves the question "can you see this yet?". A temporary public address is the shortest path to an answer, and there was no reason for it to cost anything.

Osir Tunnel is a small tool, deliberately. It does one thing, it asks for one sign-in and nothing else, and it gets out of the way when you press Ctrl+C.

FAQ

Is Osir Tunnel free?

Yes, with an OSIR account. There is no separate charge and no paid tier for it.

Do I need an OSIR account to open a tunnel?

Yes. Sign in once with osir auth login. Every tunnel is recorded against the account that opened it, which is what lets us answer an abuse report.

Can I choose my own address, or keep one between runs?

No. The address is random and lasts only as long as the command runs. If the connection drops the client reconnects and keeps the same address where it can, and during planned maintenance it is held for 120 seconds, but a new run means a new address.

Does it work with WebSockets, live reload and file uploads?

Yes. Requests reach your app unchanged, so WebSockets, server-sent events, streaming responses and large uploads all work.

My dev server says "Blocked request" or "Invalid Host header". What do I do?

Your app receives the public host name, and some dev servers reject names they do not know. Allow the domain: server.allowedHosts: ['.osir.run'] in Vite, or allowedHosts: ['.osir.run'] in webpack-dev-server.

Is it private? Who can reach my app?

Anyone with the link. The address is random and hard to guess, but there is no password in front of it. Only expose what you mean to share, and press Ctrl+C when you are done.

Can I use it in scripts or CI?

Yes. osir tunnel 3000 -o json prints a single machine-readable line once the tunnel is ready, containing the status, the local target and the public URL.

How do I report an abusive osir.run link?

Email abuse@osir.com with the full link. Every tunnel belongs to a signed-in OSIR account.

Try it: osir.run. The full documentation is in Share a local app with osir tunnel, and the rest of the CLI is covered in the developer docs.

Image generated with AI (Higgsfield).