devgate as an ngrok alternative
Both tools solve the same problem the same way: an agent on your machine holds an outbound connection, and the service publishes an HTTPS URL that forwards to your local port. If your reason for looking is HTTP tunnelling and pricing, devgate is a straight swap — devgate http 3000 is ngrok http 3000. If you need TCP, TLS or UDP tunnels or a Kubernetes operator, ngrok remains the better tool and this page says where.
What is the same, what differs
An agent next to your service opens an outbound connection; the provider terminates TLS on a public hostname and forwards traffic down it. No inbound port, no static IP, no VPN. Identical in both.
devgate http 3000 does what ngrok http 3000 does, and --url puts it on your dev domain or another of your domains the same way. The commands in the migration table below carry over word for word.
Each device registers its own key on first run — there is no shared secret to copy between machines. Endpoints are pinned to a device, and a bare run brings up only that device’s set, so a laptop and a home server never fight over the same hostname.
--host and --host-header are separate flags: one picks the socket, the other picks the vhost the local server routes on. Herd, Valet, docker and nginx server_name setups are a documented path rather than a workaround.
The running agent prints every forwarded request — method, path, status, duration, size — plus connection counters, in the terminal, and serves a local inspector on 127.0.0.1:4040 with full headers and bodies, replay and edit-and-replay, like ngrok’s.
Works like ngrok’s: metadata for every request by default, and an opt-in full capture for the account that keeps headers and the first 10 KB of each body — 24 hours on Free, 72 on paid plans — with replay from the dashboard.
The same YAML policy model — phases, CEL expressions, ngrok’s variable names — with basic-auth, oauth (Google, GitHub), openid-connect, jwt-validation, rate-limit, circuit-breaker, redirect, url-rewrite, headers, compress-response, restrict-ips, custom-response, http-request, log, verify-webhook and forward-internal, priced in the same Traffic Policy units. Cloud endpoints, internal *.internal endpoints and pooling work as on ngrok; the WAF (owasp-crs) is not there yet.
devgate exposes HTTP/S endpoints. ngrok also offers TCP, TLS and UDP tunnels — if you need to expose a database, an SSH port or a game server, that is a real gap today.
What devgate costs
Our numbers, generated from the same data the pricing page renders. ngrok’s plans change often enough that quoting them here would go stale — read them on ngrok’s own pricing page and compare against these.
| Plan | Price | Included | Endpoints |
|---|---|---|---|
| Free | free | $5 one-time usage credit | Up to 3 online endpoints |
| Hobby | $10/mo | $10 monthly usage credit | Up to 3 online endpoints |
| Pay-as-you-go | $20/mo | $20 monthly usage credit + additional usage | Unlimited online endpoints |
Full matrix and metered rates on pricing, or as plain markdown at /pricing.md.
Command-for-command
| ngrok | devgate |
|---|---|
| ngrok config add-authtoken <token> | devgate config add-authtoken <token> |
| ngrok http 3000 | devgate http 3000 |
| ngrok http 3000 --url https://<your dev domain> | devgate http 3000 --url https://<your dev domain> |
| ngrok http 3000 --url https:// | devgate http 3000 --url https:// |
| ngrok http 3000 --url https://api.example.internal | devgate http 3000 --url https://api.example.internal |
| ngrok http 3000 --traffic-policy-file policy.yml | devgate http 3000 --traffic-policy-file policy.yml |
| ngrok http 3000 --url https://<url> --pooling-enabled | devgate http 3000 --url https://<url> --pooling-enabled |
| ngrok http 80 --basic-auth "user:password" | devgate http 80 --basic-auth "user:password" |
| ngrok http 80 --cidr-allow 110.0.0.0/8 | devgate http 80 --cidr-allow 110.0.0.0/8 |
| ngrok http 80 --verify-webhook stripe --verify-webhook-secret … | devgate http 80 --verify-webhook stripe --verify-webhook-secret … |
| curl localhost:4040/api/tunnels | curl localhost:4040/api/tunnels |
| ngrok tcp 22 | devgate tcp 22 |
| ngrok tls 443 --url tls://app.example.com | devgate tls 443 --url tls://app.example.com |
| ngrok start --all | devgate start --all |
| ngrok start web api | devgate start web api |
| ngrok config check | devgate config check |
| ngrok service install --config ngrok.yml | devgate service install --config devgate.yml |
| ngrok http --host-header=rewrite 80 | devgate http 80 --host=myapp.test --host-header=rewrite |
| ngrok http --host-header=myapp.test 8080 | devgate http 8080 --host-header=myapp.test |
There is no --subdomain, --domain or --hostname flag: a reserved name is bound with --endpoint=<slug>, and a bare devgate brings up every endpoint pinned to the device at once.
Local vhosts are first-class
The single most common tunnelling failure is a named local site — myapp.test — answering with the wrong page, because the request arrives carrying the public hostname and matches no vhost. Two flags, deliberately separate:
$ devgate http 80 --host=myapp.test --host-header=rewrite The full explanation — including when rewriting the header is the wrong move, and why Vite answers “blocked request”.
When ngrok is the better choice
A comparison page that finds no reason to pick the other tool is an advertisement. Concretely, pick ngrok when you need a TCP, TLS or UDP tunnel — a database, SSH, a game server — since devgate publishes HTTP/S endpoints only; when you deploy ingress through a Kubernetes operator; or when a specific region footprint, procurement and compliance paperwork, or a support contract decides the matter.
devgate had its first public release in 2026. That is the honest frame for everything above: a smaller, newer tool that does HTTP tunnelling well and does not pretend to cover the rest yet.
Questions people actually ask
For HTTP and HTTPS tunnelling, close to it: the agent is a single binary and devgate http 3000 mirrors ngrok http 3000. Traffic Policy files, cloud and internal endpoints and pooling carry over too. It is not a replacement for ngrok’s TCP, TLS and UDP tunnels or its Kubernetes operator.
Yes. Every device registers its own key on first use and endpoints can be pinned to a device, so a laptop and a server can hold different endpoints on the same account without sharing a secret.
Yes, on a domain: every account has a dev domain that stays the same, and paid plans reserve names under devgate.run or bring their own. Start an endpoint on one with --url, or reserve an endpoint on it. A run without either gets a generated hostname that changes.
If you need non-HTTP tunnels, a Kubernetes operator, a specific region footprint, or the compliance and support commitments of a mature vendor, ngrok is the better answer today. devgate is a young product and says so.
Try it in a minute
$ brew install dmitryhawk/devgate/devgate $ devgate http 3000 Free plan, no card. Quickstart · other install options