A developer-first ngrok alternative
Secure tunnels for localhost. No annoying limits.
A secure, lightweight reverse proxy that puts your local app on the public internet in one command. URLs that don't change, built for teams, with no session expiry.
Under a minute to your first URL. Free account, one-time login.
# 1. install the CLInpm install -g resolvelabs-tunneladded 1 package in 2s# 2. expose your app's portrl-tunnel http 3000Tunnel Status: ● OnlineForwarding: https://dev-xyz.t.resolvelabs.com.br -> http://localhost:3000HTTP Requests-------------POST /api/webhooks/stripe 200 OKGET / 200 OKWhy use ResolveLabs Tunnel?
You read the docs to decide in ten seconds. Here are the reasons.
Zero friction
No firewall rules, router ports, DNS records or VPN. One install, one command, one public HTTPS URL.
URLs that survive restarts
Reserve a persistent subdomain and stop updating webhook URLs in Stripe, GitHub or Twilio every time you restart your laptop.
No arbitrary session limits
Leave the tunnel open all day. We don't cut your session after a couple of hours or throttle connections to push you into a plan.
Secure by default
Traffic is intercepted at our Edge servers before it reaches your machine, so you decide exactly who comes in.
How it works
The CLI opens an encrypted outbound connection. Nothing is opened on your network.
- 1
Install the CLI
Available on npm for macOS, Linux and Windows.
- 2
Point it at a port
Tell rl-tunnel where your app is listening, for example port 3000.
- 3
Share the URL
Anyone with the link reaches your local app over HTTPS, through our Edge.
npm install -g resolvelabs-tunnelrl-tunnel http 3000Everything the tunnel does
From a quick demo to a team workflow, in a single CLI.
Persistent URLs
Reserve a subdomain in your free account and use it with --subdomain. Configure webhooks and OAuth once.
Zero Trust security
Nothing is exposed by default. Add Basic Auth, restrict by IP and limit access to the single port you choose.
No session limits
No forced expiry and no artificial caps. Tunnels reconnect automatically after a network drop.
Traffic inspector
Every request gets an ID in your terminal. Run rl-tunnel inspect to see its headers and body, with secrets masked.
Replay in one command
Resend any captured webhook to your app with rl-tunnel replay. Fix the handler and try again without triggering the event.
TCP tunnels
Expose PostgreSQL, Redis, SSH or any TCP service temporarily to another developer with rl-tunnel tcp.
HTTPS everywhere
Every HTTP tunnel gets a valid TLS certificate, which is what payment and messaging providers require for webhooks.
Built for the terminal and CI
Log in from the browser once, or use an access token in your pipeline to open preview URLs.
Multiple tunnels at once
Describe web, API and database tunnels in rl-tunnel.yml and start them together with rl-tunnel start --all.
Built for real dev workflows
The situations where localhost is not enough.
- Webhooks
Webhooks and third-party APIs
Integrate payment providers (Stripe, Mercado Pago) or messaging services (Twilio, WhatsApp) straight into your local environment. ResolveLabs Tunnel gives you the public HTTPS URL these platforms require and forwards the real POSTs to your console.
- Demos & QA
Live demos and QA
Need to show the current branch to a client or the QA team? Instead of waiting for a staging build and deploy, open a tunnel and share the link. They see exactly the code you just saved.
- Mobile
Native mobile testing
Reach your local API from a phone on 4G to test real responsiveness and native behavior, without worrying about corporate Wi-Fi restrictions.
- Databases
Temporary database access
Give another developer short-lived access to your local PostgreSQL, Redis or SSH with a TCP tunnel, then close it when you are done.
Controlled exposure, secure by default
Opening your localhost to the world takes responsibility. ResolveLabs Tunnel intercepts traffic on our Edge servers before it reaches your machine, so you control exactly who gets in.
Traffic inspection
Follow every request (headers, body, status code) in your terminal to debug API responses quickly.
Password protection (Basic Auth)
Keep curious people and bots out with one flag. The check runs at the Edge, before traffic touches your machine.
Port isolation
The tunnel is strict. It can only reach the port named in the command, keeping the rest of your file system and databases isolated and invisible.
IP allowlist
Restrict a tunnel to your office, VPN or a client's IP ranges with --allow-ip.
rl-tunnel http 3000 --auth "admin:password123"# Only these IPs/ranges can reach the tunnelrl-tunnel http 3000 --allow-ip 203.0.113.0/24 --allow-ip 198.51.100.7HTTP Requests-------------#1 POST /api/webhooks/stripe 200 OK 42ms#2 GET /api/orders/981 404 Not Found 6ms#3 POST /api/login 500 Internal Server Error 120msWhat changes compared to typical free tunnels
The limits that interrupt your work are the ones we removed.
| What changes compared to typical free tunnels | Typical free tunnel | ResolveLabs Tunnel |
|---|---|---|
| Session length | Expires after a few hours | No arbitrary limit |
| URL after restart | Random, changes every time | Persistent subdomain (free account) |
| Sharing with the team | Everyone reconfigures webhooks | One fixed URL for everyone |
| TCP tunnels | Often paid or limited | Included with a free account: rl-tunnel tcp |
| Traffic inspection | Separate web dashboard | In your terminal, with replay |
| Access control | Open to anyone with the link | Basic Auth and IP allowlist at the Edge |
A free account is required. It includes reserved subdomains and TCP tunnels.
Quick docs
The commands you will use every day, ready to copy.
Expose a local port with HTTPS. Add --subdomain to keep the same address, or use tcp for non-HTTP services.
# Expose localhost:3000rl-tunnel http 3000# Persistent URL (reserve the name in your dashboard first)rl-tunnel http 3000 --subdomain my-app# Expose a TCP service (e.g. PostgreSQL)rl-tunnel tcp 5432Frequently asked questions
What is ResolveLabs Tunnel?
A secure, lightweight reverse proxy that exposes services running on your localhost to the public internet. It removes the need to configure firewalls, routers, DNS or VPNs.
Is it an ngrok alternative?
Yes. It solves the same problem (a public URL for your local app) with a focus on two things: no arbitrary session limits and persistent URLs for development teams.
Do I need an account?
Yes, a free one. Run rl-tunnel auth login (or just rl-tunnel http 3000: the CLI offers to log in) and approve in the browser. The account gives you reserved subdomains, TCP tunnels and access tokens for CI.
Which platforms are supported?
macOS, Linux and Windows. The CLI is a native binary that you install with npm (npm only delivers the right one for your system), so Node.js is just for installing it this way.
Does the URL change every time I restart?
If you have a reserved subdomain, the CLI uses it (and asks which one if you have several), so the URL stays the same across restarts. With --random-url you get a random one (like dev-xyz.t.resolvelabs.com.br).
Is my machine exposed to the internet?
No. The CLI opens an outbound encrypted connection to our Edge, and the tunnel can only reach the port you specify. Add Basic Auth or an IP allowlist to control who can access it. Note that TLS ends at our Edge, so it is not end-to-end encryption.
Can I expose a database?
Yes, with a TCP tunnel (rl-tunnel tcp 5432, needs a free account), which is ideal for giving a colleague temporary access. Always protect the database with strong credentials and close the tunnel afterwards.
Does it work for webhooks from Stripe, Twilio or GitHub?
Yes. Every HTTP tunnel gets a valid HTTPS URL, and each request is printed in your terminal so you can see the exact payload and your response.
From zero to the internet in 30 seconds
Two commands. No firewall, no DNS, no VPN.