Instant, Encrypted Tunnels
For Developers
Expose your local development servers, Stripe/Shopify webhooks, and WebSocket backends to the internet in seconds with authenticated ECDH key agreement and AES-256-GCM.
✓ Authenticated • Token verified
✓ Key agreement complete • ECDH P-256 + AES-256-GCM
Fingerprint: SHA256:7a:91:4f:2c:81:d3:05:e2:39:11:bc:54
Public URL: https://my-app.tunnel.explita.ng
Forwarding: http://localhost:3000
Inspector: http://127.0.0.1:39755 (Press 'r' to replay)
200 OKGET/api/auth/session11ms
101 SWWSS/ws/live-stream[Encrypted Frame]2ms
200 OKPOST/webhooks/stripe[Signature Verified]28ms
Engineered For Speed, Privacy & Webhook Testing
Everything you need to expose local development servers without leaking sensitive payloads to third-party cloud providers.
Inner ECDH + AES-256-GCM
Automatic ephemeral ECDH (P-256) key agreement with AES-256-GCM authenticated encryption for every request and response payload.
Local Web & Wire Inspector
Built-in zero-dependency local dashboard on http://127.0.0.1:39755. Inspect real-time SSE streams, headers, and press "r" to replay requests.
Multi-Tenant Nested Subdomains
Route multi-tenant SaaS subdomains (tenant--myapp.tunnel.explita.ng) under single wildcard TLS with injected x-explita-* context headers.
IP & CIDR Firewall
Restrict tunnel access exclusively to authorized developer IPs or trusted webhook providers (Stripe, GitHub, Shopify) with -i, --allow-ip.
Persistent Custom Subdomains
Claim memorable, stable subdomains with -s, --subdomain (3 to 32 characters) so your webhook URLs remain persistent across reconnects.
Full WebSocket & SSE Streaming
Seamless proxying for Next.js, Vite, Turbopack, and WebSocket applications with zero-delay chunk streaming for Server-Sent Events.
Production Guardrails
100 req/s sliding-window rate limiter per tunnel, 25MB payload bounds, 60s atomic reconnect grace, and untrusted header sanitization.
Zero-Logging Architecture
We never log, persist, or inspect request bodies, authorization headers, or WebSocket frames on disk or in remote databases.
Built For The Way Developers Build
From webhook integrations to live mobile previews, eliminate the friction of testing localhost on the public internet.
Stripe, Shopify & GitHub Webhooks
Test third-party webhooks directly against your local handlers with zero deployment delays. Lock in a stable custom subdomain with -s so you never have to reconfigure developer webhook dashboards when restarting tunnels.
OAuth & Social Sign-In Callbacks
Google, GitHub, and Apple Sign-In reject plain http://localhost redirect URIs. Explita provides instant, valid TLS 1.3 wildcard certificates so authentication handshakes complete smoothly on your local machine.
Mobile & Physical Device Previews
Test your responsive web application on physical iPhones, iPads, and Android devices over cellular data or external Wi-Fi networks without installing self-signed root certificates or messing with LAN IP routing.
Instant Teammate & Client Demos
Demo a work-in-progress feature to a product manager, designer, or client directly from your laptop before merging PRs or waiting on staging builds. Every session is encrypted with ECDH P-256 for privacy.
Multi-Tenant SaaS Subdomain Testing
Test tenant-isolated customer spaces (e.g. acme--myapp.tunnel.explita.ng) without editing /etc/hosts or setting up local DNS servers. Headers like x-explita-tenant are automatically injected.
AI Token Streaming & WebSockets
Develop LLM streaming interfaces with Server-Sent Events (SSE) without edge buffering delays. Full bidirectional binary and text WebSocket support keeps collaborative tools, games, and chat apps responsive.
Test Nested Subdomains Under Standard Wildcard TLS
Standard wildcard certificates only cover a single subdomain depth. We solved multi-tenant SaaS local testing using double hyphens (--) with zero DNS overhead and automatic header injection.
Single Wildcard Subdomain Mapping
When exposing your multi-tenant app with eta 3000 -s my-app, any request with a tenant prefix before -- automatically routes to your tunnel:
Both dot notation (tenant.my-app) and double-hyphen notation (tenant--my-app) are recursively resolved.
Automatic Injected Context Headers
Your local application backend automatically receives structured x-explita-* headers to identify the tenant without parsing URLs manually:
| Header Name | Injected Value |
|---|---|
| x-explita-tenant | "acme" |
| x-explita-subdomain | "acme--my-app" |
| x-explita-parent-subdomain | "my-app" |
| x-explita-subdomain-prefix | "acme" |
| x-explita-client-ip | <caller-real-ip> |
Untrusted caller-supplied x-explita-* headers are sanitized at the gateway to prevent spoofing.
How Explita Tunnel Compares
Engineered for developers and security-conscious engineering teams who demand complete control over payload privacy, subdomains, and webhook traffic.
| Capabilities | Explita Tunnel | ngrok | Cloudflare Tunnels | Localtunnel |
|---|---|---|---|---|
Inner Payload CryptographySecurity | ECDH P-256 + AES-256-GCM | No | No | No |
Zero-Log Edge ArchitectureSecurity | Yes | No | No | Unverifiable |
Self-Hosted Private GatewayDeployment | 1-Command (Docker / Node) | No | Connector only | Basic repo |
Local Web & Wire InspectorDeveloper Experience | Live SSE + Terminal Replay ('r') | Web UI (127.0.0.1:4040) | No | No |
Multi-Tenant Subdomains (--)Routing | Native Wildcard TLS | Paid Enterprise | Requires Cloudflare DNS | No |
Edge Anycast PoP NetworkInfrastructure | Your Own Server / Cluster | Global Anycast PoPs | 300+ Global Anycast PoPs | Community Servers |
Free Persistent SubdomainsPricing | Unlimited on your host | 1 static domain | Requires Cloudflare DNS | Random / Collisions |
IP / CIDR Firewall FilteringSecurity | Built-in (-i, --allow-ip) | Paid tier ($20/mo+) | Zero Trust policy | No |
Cloud Vendor Lock-inOwnership | Zero (100% Open Source) | Proprietary Cloud | Cloudflare Ecosystem | Community hosted |
We Don't Log Your Traffic.
Anywhere. At Any Time.
Your source code, webhook payloads, internal API calls, and credentials belong to you alone. Explita Infra is engineered from the ground up with zero persistent data collection.
Zero Logging Policy
We do not log, persist, store, or inspect HTTP request bodies, response payloads, authorization headers, cookies, or WebSocket frames on disk or in remote databases.
Ephemeral In-Memory Streaming
All traffic flows strictly through ephemeral, in-memory proxy buffers. Once a request chunk or WebSocket stream reaches your machine, the buffer is immediately reclaimed.
Inner Tunnel Cryptography
Every tunnel session negotiates a unique cryptographic session key using ECDH (P-256) between the gateway and your dev PC, encrypting all messages with authenticated AES-256-GCM across the WebSocket link.
Local Inspection Only
Observability stays entirely on your own computer. The web inspector UI (127.0.0.1:39755) and CLI wire logger process frames in local agent memory, never through the edge server.
Our Transparency & Open Privacy Commitment
Privacy is a foundational architectural choice, not marketing. The edge gateway only maintains anonymous, high-level numeric counters (total requests routed and bytes relayed) to monitor capacity, with zero payload inspection.
Explita Tunnel Quickstart Guide
Get your tunnel running in seconds with zero complicated configuration.
Step 1: Install Global CLI
Installs the Explita CLI suite, providing the explita, eta (tunnel), and eda (deploy) binaries.
pnpm add -g @explita/cli
Step 2: Instant Tunnel Forwarding
Spins up an ephemeral HTTPS tunnel forwarding to localhost:3000 with inner encryption.
explita tunnel 3000 # or shorthand: eta 3000
Step 3: Reserve a Custom Subdomain & Launch Inspector
Claims https://my-app.tunnel.explita.ng and launches the local web inspector dashboard.
eta 3000 -s my-app --inspect 39755
Commands
Primary executable verbs available via the eta binary.
| Command | Type | Description | Example |
|---|---|---|---|
| eta <port> | Primary | Expose local HTTP/WS port with an encrypted tunnel | eta 3000 |
| eta | Zero-Config | Start tunnel using settings from local .etarc configuration | eta |
| eta init [port] [options] | Scaffold | Initialize or update project-level .etarc configuration (-s, -a, -i, -H) | eta init 3000 -s my-app -i '1.2.3.4' |
| eta config [cmd] | Manage | View or edit local and global configuration (list, get, set, path) | eta config set hostHeader rewrite |
Options & Flags
Flags available when running eta [port] [options].
| Flag / Option | Type | Default | Description | Example |
|---|---|---|---|---|
| -p, --port <num> | Required* | None | Local TCP port of running server (*optional if specified in .etarc) | eta 3000 |
| -s, --subdomain <name> | Optional | Random 8-char | Request custom subdomain (3 to 32 chars: a-z, 0-9, hyphens) | eta 3000 -s webhook-api |
| -a, --auth <user:pass> | Optional | None | Protect tunnel endpoint with HTTP Basic Authentication | eta 3000 -a 'alice:secret' |
| -i, --allow-ip <cidr> | Optional | None | Restrict access to specific IP or CIDR ranges (HTTP 403 Forbidden) | eta 3000 -i '1.2.3.4, 10.0.0.0/8' |
| -H, --host-header <host> | Optional | Preserves tunnel host | Rewrite Host header to target or custom host (e.g. rewrite for Vite/Next.js) | eta 3000 -H rewrite |
| -t, --token <token> | Optional | Saved in config | Developer authentication token (or via TUNNEL_TOKEN env variable) | eta 3000 -t tok_abc... |
| --inspect [port] | Optional | 39755 | Enable local request inspector web dashboard on 127.0.0.1 | eta 3000 --inspect 5000 |
| --no-inspect | Flag | false | Disable local request inspector web dashboard (runs in quiet/headless mode) | eta 3000 --no-inspect |
| -R, --no-reconnect | Flag | false | Do not automatically reconnect if the connection drops | eta 3000 -R |
| -E, --no-encrypt | Flag | false | Disable inner application-layer encryption (debug mode) | eta 3000 -E |
| -S, --server <url> | Optional | Public Gateway | Custom WebSocket tunnel gateway server URL | eta 3000 -S wss://tunnel.explita.ng/_connect |
| -v, --version | Flag | false | Display client version and build commit | eta -v |
http://127.0.0.1:39755) runs 100% in local memory on your computer. Request bodies, response payloads, and headers are buffered exclusively on your machine and never pass through or get inspected by the remote tunnel gateway.Interactive Terminal Hotkeys
Press any of these keys while an active eta terminal session is running.
| Key | Action | Description |
|---|---|---|
| r | Replay | Replay the latest received HTTP request directly against your local server |
| c | Clear | Clear the terminal screen output buffer without dropping active tunnels |
| h | Help | Toggle the interactive terminal hotkey help display |
Tunnel Frequently Asked Questions
Everything you need to know about Explita reverse tunnels, security, bandwidth, custom domains, and protocol details.