Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/outray-tunnel/outray/llms.txt

Use this file to discover all available pages before exploring further.

Password protection lets you gate access to your HTTP tunnel behind a password. When enabled, any visitor who navigates to the tunnel URL is presented with a browser-native login dialog before they can reach your local service.
Password-protected tunnels are available on paid plans. View pricing →

​
Protect a tunnel with the CLI

Use the --password flag when starting an HTTP tunnel: 
outray http 3000 --password mysecret
You can also use the shorthand port-only syntax: 
outray 3000 --password mysecret

​
Protect a tunnel in config.toml

Add the password key to a tunnel block in outray/config.toml: 
[tunnel.web]
protocol = "http"
local_port = 3000
password = "mysecret"
Then start your tunnels: 
outray start

​
Visitor experience

When a visitor opens a password-protected tunnel URL, their browser displays a native HTTP Basic Auth prompt. They can enter any value (or leave it blank) in the username field — only the password is checked. Entering the correct password grants access for the remainder of the browser session.

​
Programmatic access

If you are calling a password-protected tunnel from a script, curl, or a webhook provider, include the credentials in the request: 
curl -u :mysecret https://my-tunnel.tunnel.outray.app/api/health
The username field is ignored by OutRay — only the password is validated. Pass any value or leave it empty as shown above.

​
Limitations

  • Password protection applies to HTTP tunnels only. TCP and UDP tunnels do not support this feature.
  • The password is transmitted over HTTPS (all OutRay tunnels use TLS), so it is encrypted in transit.
  • There is no per-user account system; the same password applies to all visitors.

​
Use cases

  • Webhook testing — prevent unauthorized payloads from reaching your local dev server.
  • Staging previews — share a work-in-progress with your team without making it publicly accessible.
  • Client demos — give a client temporary access to a feature without opening it to the entire internet.