CLI Reference (eta)
Complete command-line interface reference for the Explita Tunnel client
Tunnel CLI Reference (eta)
The Explita Tunnel client is provided by @explita/cli. It exposes the primary command explita tunnel along with the convenient short binary alias eta.
🛠️ Command Syntax
eta [port] [options]
# or:
explita tunnel [port] [options]If no port is passed, the CLI checks the local directory for an explita.json file.
⚙️ Options & Flags Reference
| Flag | Type | Description |
|---|---|---|
-p, --port <number> | number | The local port to expose (e.g. 3000, 8080, 5173) |
-s, --subdomain <name> | string | Request a custom subdomain prefix (3 to 32 characters, lowercase alphanumeric and hyphens) |
-a, --auth <user:pass> | string | Protect incoming traffic with HTTP Basic Authentication (e.g. -a "admin:secret") |
-i, --allow-ip <cidr> | string | Restrict tunnel access to specific IPs or CIDR blocks (e.g. -i "192.0.2.1/32, 10.0.0.0/8") |
-H, --host-header <host> | string | Rewrite the incoming Host header to rewrite (uses target host) or a custom domain |
--host <host> | string | Target host to forward to (default: localhost) |
--target <url> | string | Full target URL to proxy to (e.g. http://192.168.1.50:8000) |
-S, --server <url> | string | Custom tunnel server WebSocket URL (default: wss://tunnel.explita.ng/_connect) |
-t, --token <token> | string | Authentication token for the tunnel server |
-R, --no-reconnect | flag | Do not automatically reconnect if the connection drops |
-E, --no-encrypt | flag | Disable inner ECDH/AES-256 payload encryption (transmits plaintext JSON frames) |
--inspect [port] | number | Enable local request inspector web UI on a custom port (default: 39755) |
--no-inspect | flag | Disable the local request inspector web dashboard completely |
-h, --help | flag | Display command help and exit |
🔑 Token Management (eta token)
Authenticate your developer workstation with the tunnel server using passwordless email OTP:
1. Request a Verification Code
eta token -e [email protected]2. Verify and Save Token
eta token -e [email protected] -v 849201Once verified, the issued token (exp_live_...) is saved to ~/.explita/config.json and used automatically for all future tunnel sessions.
Other Token Subcommands
# View the currently active saved token
eta token
# Clear the saved token from your workstation
eta token --clear📁 Project Configuration (explita.json)
To share tunnel settings across your team or repository, initialize a local project config:
eta init 3000 -s my-appThis creates an explita.json file in your repository:
{
"$schema": "https://infra.explita.ng/config/schema.json",
"tunnel": {
"port": 3000,
"subdomain": "my-app",
"inspect": 39755,
"allowIp": ["192.30.252.0/22", "185.199.108.0/22"]
}
}Now, anyone on your team can run:
etaThe CLI automatically reads the configuration and starts the tunnel with the designated settings.
💡 Practical Examples
1. Expose a Next.js / Vite Dev Server
eta 30002. Expose a Docker Container or LAN Device
To proxy traffic to a local virtual machine or Docker container listening on a separate IP:
eta --target http://192.168.1.100:8080 -s dev-vm3. Secure Webhook Endpoint with Basic Auth and CIDR Filter
eta 4000 -s stripe-receiver \
-a "webhook_user:SecureKey2026" \
-i "3.18.12.63/32, 3.130.192.212/32"4. Rewrite Host Header for Virtual Hosts
Some web applications (such as WordPress or multi-domain servers) reject requests whose Host header does not match their local configuration. Use -H rewrite:
eta 80 --host vhost.local -H rewrite5. Connect to a Self-Hosted Tunnel Server
eta 3000 -S wss://tunnel.mycompany.internal/_connect