Traffic inspector

Every tunnel prints a live log of the requests it receives, each with an ID. Use the ID to see the whole exchange or to send the request to your app again. Debugging an API or a webhook takes seconds.

HTTP Requests-------------#1  POST  /api/webhooks/stripe   200 OK                    42ms#2  GET   /api/orders/981        404 Not Found              6ms#3  POST  /api/login             500 Internal Server Error 120ms

Request details

Pass the ID from the log to rl-tunnel inspect (or --last for the most recent request):

# Full request and response of entry #3 from the live logrl-tunnel inspect 3# The most recent onerl-tunnel inspect --last# Authorization/Cookie values are masked; show them only when you need torl-tunnel inspect 3 --reveal

#1  POST /api/webhooks/stripe  ->  200 OK  (42ms)2026-10-05 14:11:14  de 203.0.113.9  para localhost:3000Request  POST /api/webhooks/stripe  Host: my-app.t.resolvelabs.com.br  Content-Type: application/json  Stripe-Signature: t=1738...,v1=5c1f...  X-Forwarded-For: 203.0.113.9Body (35 bytes)  {"type":"payment_intent.succeeded"}Response  200 OK  Content-Type: application/jsonBody (17 bytes)  {"received":true}

The request headers are exactly what your app received: with the real X-Forwarded-For and without the tunnel's Basic Auth credentials. Authorization, Cookie and similar values are masked on screen. Add --reveal to show them.

Replay a request

rl-tunnel replay sends a recorded request to your local app again: same method, path, headers and body. It is perfect for webhooks: fix your handler and resend, without triggering the event on the provider.

# Resend the last request to your app (e.g. a webhook, after fixing a bug)rl-tunnel replay --last# A specific one, to another portrl-tunnel replay 3 --target 3001

The replay adds a X-RL-Replay: 1 header so your app can tell it from a real delivery. It always goes to your own machine, never through the internet.

Debugging workflow

• A webhook returns 500? rl-tunnel inspect --last, fix the code, rl-tunnel replay --last.
• Signature validation fails? Compare the Stripe-Signature header and body in the inspector with what your server computed.
• A mobile app gets 404? The path in the log shows exactly what it requested.

Privacy, history and logs

Request bodies can contain sensitive data. Capture nothing but the metadata with --no-body, or write every request to a file for later analysis with --log:

# Don't capture bodies (sensitive data): only method, path, headers and statusrl-tunnel http 3000 --no-body# Also save every request to a file (JSON lines)rl-tunnel http 3000 --log ./requests.log

The last 200 requests are kept in a file on your machine (permission 0600), only so inspect and replay work. Headers and, unless you use --no-body, bodies are in it: treat it as sensitive. The ResolveLabs servers do not store them.

# Where the local history lives (default: your config folder, permission 0600)export RL_TUNNEL_HISTORY=$HOME/.rl-history.jsonl# Turn it off completely (inspect and replay stop working)export RL_TUNNEL_NO_HISTORY=1