Cruma
DashboardDownload

Blog

Share a local dev server with your phone or a client in one command

· by Olof Blomqvist

Give localhost a public HTTPS URL with one command, open it on your phone or send it to a client, and see every request that arrives.

Your app runs on localhost:3000. It looks right in your desktop browser, but now you need to see it on a real phone, or a client needs to click through it before they sign off. Neither of them can reach localhost.

Cruma gives that port a public HTTPS address with one command. You need no account and no router settings, and it works behind CGNAT and strict firewalls. Here's the whole loop, from dev server to shared link.

1. Start your dev server

Start it the way you always do, with any framework. Cruma forwards HTTP to whatever answers on the port. Note the port; the examples here use 3000.

2. Give it a public URL

Install the agent with the line for your system:

  • macOS (Apple Silicon): brew install --cask umbra-yurei/brew/cruma
  • Linux (x86_64, arm64): curl -fsSL https://files.cruma.io/files/tunnel-agent/install/linux-install.sh | bash
  • Windows: winget install 9NXKT3W34HVL --source msstore

Then point it at the port:

cruma proxy http 3000

With Node.js on Linux, macOS (Apple Silicon) or Windows (x64), you can skip the install. This runs Cruma without installing it:

npx -y cruma proxy http 3000

The terminal prints an address like https://abc123.tun.cruma.io. That's your dev server, reachable from anywhere over HTTPS. If your dev server serves HTTPS itself, use cruma proxy https instead.

3. Open it on your phone, send it to a client

The terminal UI that cruma proxy opens shows a QR code for your public URL. Scan it with your phone to see your dev server on a real device.

For a client, send the link. Keep in mind that anyone who has the URL can open it. To keep it to the people you send it to, add a user name and password:

cruma proxy http 3000 --user alice s3cret

That puts a sign-in form in front of your app. For an API, --api-key X-API-Key <value> requires that header on every request instead.

4. Webhooks pass straight through

On anonymous and free tunnels, browser visitors see a warning page before they reach your app. After they choose Continue, a cookie skips it for 30 days, so your client sees it once. Basic and Pro tunnels don't show it.

Webhook deliveries, curl and other non-browser requests skip the page and go straight to your server. So the same URL works for a payment provider's webhook while you click through the UI on your phone. To skip the page from a browser-like client, send the request header X-Skip-Browser-Warning: 1.

5. See what arrived

When the page looks wrong on your phone, or a webhook seems to vanish, you want to know what actually reached your machine. The terminal UI has a requests page. For the full picture, use the desktop app for Windows, macOS or Linux, which does the same job without a command: on the Dashboard, pick Share a Web Service, enter your service's address (such as 127.0.0.1:3000) and a short hostname, and save. Your site appears under Active Routes, with copy and open buttons and a QR code for your phone.

Then open Requests, turn recording on, and reload the page. Each request shows its status, method, host, path, time, size and source address. Click one to see its headers, body and timing. cURL copies it as a curl command you can replay in a terminal, and Ask AI hands it to the built-in assistant to ask what went wrong.

The Requests page with a list of HTTP requests and one expanded to show Request, Response and Timing tabs and buttons for Request, cURL and Ask AI The Requests page with a list of HTTP requests and one expanded to show Request, Response and Timing tabs and buttons for Request, cURL and Ask AI
Requests: every request through the agent, with headers, body and timing.

The request logs stay on your machine. Watching your traffic covers the rest of the app's live views, and Your first site in the app walks through the wizard step by step.

6. Know the limits

  • Anonymous, no account at all: up to 3 hours and 1 GiB of traffic per session. A session starts when the agent starts, and restarting the agent starts a new one. Past a limit, visitors get an HTTP 429 page that names it.
  • Free account: no time limit and up to 3 GiB of traffic a day, for personal, non-commercial use. Run cruma auth login to sign in and put the agent on one of your tunnels.

For a quick check on your phone, anonymous is plenty. For a client demo that runs all afternoon, sign in first. Rate limits has every number.

7. When to move to your own domain

A tun.cruma.io address is fine for a quick look. When the link goes to a client, Basic ($5/month) is the step up:

  • Your own domain. Point a CNAME at your tunnel and the agent gets its own certificate from Let's Encrypt, automatically.
  • End-to-end encryption. On your own domain, TLS ends on your machine. Cruma forwards the encrypted stream and can't read it. On anonymous and free tunnels, TLS ends at Cruma's edge.
  • No warning page for browser visitors.
  • No monthly cap. A 750 GB full-speed allowance refills continuously, and sustained heavy use beyond it slows down instead of being cut off.

See Pricing for every plan, Custom domain names for the CNAME setup, and Security for where TLS ends on each plan.

Try it

Download the agent, start your dev server and run cruma proxy http 3000. Then scan the code and send the link. Share localhost has the short version of this guide, and the Quick start lists every proxy and serve option.

← All posts