HTTP tunnels

Expose a local HTTP server to the internet with a public URL.

HTTP tunnels give your local server a public HTTPS URL that anyone can access. WebSocket connections are passed through automatically — no extra configuration needed.

Basic usage

outray http 3000

You can also omit the http subcommand and pass the port directly:

outray 3000

Once the tunnel is established, you’ll see output like this:

Connecting to OutRay...
Linked to your local port 3000
✨ Tunnel ready: https://random-name.tunnel.outray.app
Keep this running to keep your tunnel active.

The public URL uses a randomly assigned subdomain under tunnel.outray.app. Use --subdomain or --domain to control this.

Flags

Flag	Type	Description
--subdomain <name>	string	Request a specific subdomain (e.g. my-app → my-app.tunnel.outray.app).
--domain <domain>	string	Use a custom domain configured in your OutRay dashboard.
--password <password>	string	Protect the tunnel with HTTP basic auth. Requires a paid plan.
--org <slug>	string	Open the tunnel under a different organization without switching your active org.
--key <token>	string	Override the auth token. Useful for CI/CD or scripted environments.
--no-logs	boolean	Suppress per-request log output in the terminal.
--local	boolean	Advertise the tunnel on your LAN via mDNS in addition to the public URL.
--local-only	boolean	LAN-only mode — no remote tunnel is opened. See below.

Custom subdomains and domains

Request a specific subdomain with --subdomain:

outray http 3000 --subdomain my-app
# → https://my-app.tunnel.outray.app

If the subdomain is already in use, OutRay will ask whether you want to take it over, use a random one, or exit.

Use a custom domain you’ve configured in your dashboard with --domain:

outray http 3000 --domain app.example.com

Password protection

Add HTTP basic auth to your tunnel:

outray http 3000 --password mysecret

Password-protected tunnels require a paid plan. If you’re on a free plan, the tunnel will fail to open with a PASSWORD_REQUIRES_PAID error.

LAN-only mode

--local-only opens a server accessible only to devices on your local network. No remote tunnel is created, so no authentication is required.

outray http 3000 --local-only

OutRay advertises your server via mDNS (Bonjour/Avahi). Other devices on your network can reach it at:

https://<subdomain>.local   # HTTPS (self-signed, or trusted if mkcert is installed)
http://<subdomain>.local    # HTTP
http://<local-ip>:3000      # Direct IP for Android devices

The subdomain defaults to local-<port> (e.g. local-3000). Override it with --subdomain:

outray http 3000 --local-only --subdomain myapp
# → http://myapp.local

Install mkcert to get a locally trusted HTTPS certificate instead of a self-signed one:

brew install mkcert && mkcert -install

LAN advertising alongside a public tunnel

Use --local (not --local-only) to get both a public URL and LAN access at the same time:

outray http 3000 --local

WebSocket support

WebSocket connections are proxied automatically through HTTP tunnels. No extra flags or configuration are needed. You’ll see WS log entries in the terminal as WebSocket connections open and close.

Switching organizations temporarily

Use --org to open a tunnel under a specific organization without changing your active org:

outray http 3000 --org staging-team

Stopping the tunnel

Press Ctrl+C to stop the tunnel. OutRay shuts down gracefully and the public URL becomes inaccessible.