Changelog

devgate now has its own signed apt repository: the Linux tab in the dashboard has the command, and the agent updates with the rest of your system through apt upgrade. There are also 32-bit Linux builds, 386 and ARMv6, which runs on every Raspberry Pi. The install script picks the right one, and the Download tab lets you choose an architecture, then fetch the binary in the browser or with one curl command. Homebrew is no longer the suggested way on Linux.

In a window too small for the full-size code, Ctrl+S now draws the compact one with background colours wherever it can, so line spacing no longer cuts white stripes through its dark modules. It takes the same 19 or so rows as before.

When the window is too small for the QR code without gaps, the hint now says what is short — “at least 43 rows tall (now 35)” — instead of a window size that read as an exact one.

Ctrl+S draws the QR code with a background colour per cell when the window has room, so terminals with extra line spacing no longer cut it into stripes a camera can’t read. A smaller window still gets the compact version, with the size that draws it without gaps.

The terminal view redraws only the lines that change and no longer scrolls, so a URL you select stays selected while requests come in; Ctrl+U shows only when there is an update. Ctrl+S shows an endpoint’s URL as a QR code to open it on a phone. devgate diagnose checks the config file, DNS, TLS, your authtoken and the tunnel server’s port, as ngrok diagnose does, and devgate update updates the agent from a script. --log, --log-format and --log-level — and log, log_format, log_level under agent: in the config file — log to stdout, stderr or a file, as term, logfmt or JSON. --proxy-proto 1|2 hands TCP and TLS services the client’s address in a PROXY header, --upstream-protocol http2 speaks HTTP/2 (h2c) to services such as gRPC servers, and --compression turns on compress-response.

jwt-validation lets only requests with a valid JWT through — checked against your issuer’s JWKS, issuer, audience and expiry. compress-response gzips (or Brotli-compresses) answers as they stream. circuit-breaker answers 503 while your upstream keeps failing, then lets traffic back. http-request calls another URL from a policy and lets later rules act on the answer, never reaching private networks. log records metadata that the Traffic Inspector shows with the request. Names, fields and Traffic Policy units are ngrok’s.

As on ngrok, connections to TCP and TLS endpoints are their own meter: 5k a month included, then $2 per 100k, shown on Usage and on each endpoint. HTTP/S requests now count every request — the agent counted a connection the edge kept open for many as one. Older agents keep working: what a TCP or TLS endpoint reports is filed as connections, never twice.

Pay-as-you-go no longer caps the team: 3 seats are included and each one after is $5 a month, as on ngrok. A month is billed for the most seats it had, as a line in that month’s usage — paid from the credit first, then with any other additional usage. Pending invitations cost nothing. Free and Hobby stay single-user.

Usage is counted per calendar month (UTC) for every account, as on ngrok: included transfer and requests, Free’s caps and a paid plan’s credit reset on the 1st, and Pay-as-you-go overage is billed per month. Free’s $5 credit is now one-time: granted at sign-up, good for a year, spent only while on Free. Once it is spent or expired, your dev domain keeps serving — it never costs credit — and the rest stops until you upgrade. Billing shows what is left and when it expires.

After sign-up the dashboard asks where you want to begin — Share Localhost or Gateway — and walks you from installing the agent to a live endpoint on your dev domain: the command with your domain filled in, in a terminal or the config file, a status that turns green when the agent connects, and one-flag ways to lock it down. The sidebar’s Quickstart takes you back to it.

A reserved endpoint no longer gets a {username}-{slug} address of its own: you pick one of your domains for it — the dev domain every account has, a branded name under devgate.run, or your own — as on ngrok. Existing ones moved to a branded name of the same slug and keep their port, device and settings. Sign-up no longer asks for a username.

The agent reads requests and responses side by side, and a quick local service could answer before the agent had filed the request — on a busy machine that request stayed in the inspector and the agent API without its response. A request is now filed as soon as its headers are read, and a response waits briefly for it. 100 Continue no longer takes the final response’s place.

Hobby and Pay-as-you-go include 5 GB of data transfer and 100k HTTP/S requests each cycle at no cost to the credit; only what goes past them is metered. Free includes 1 GB and 20k requests, and its credit now goes to endpoint hours instead. Every account has a per-minute limit across its endpoints — 4k HTTP requests on Free, 20k on paid plans, and 150 or 600 TCP/TLS connections — answered with a 429 at the edge. Hobby can reserve up to 10 branded domains, and Pay-as-you-go is billed monthly only — its usage is billed every month anyway. The pricing page lists everything each plan includes.

Tunnels no longer share a domain with this site, as on ngrok: random URLs, reserved endpoints ({username}-{slug}) and dev domains are served from devgate-free.run, and what you pay for — branded domains, custom-domain CNAME targets, tcp — from devgate.run. devgate.online is only the site and the dashboard now. No agent update is needed; the dashboard shows the new addresses.

Every endpoint on the Endpoints page has a ⋯ menu, as on ngrok: Inspect Traffic, Agent Details (version, OS, IP address, device, start and last heartbeat), its Traffic Policy and Stop Endpoint — the agent drops that endpoint and keeps its others running until it restarts. Stopping needs agent 0.20.0.

Invite teammates to your account as admins or members: they share its endpoints, domains and traffic, switch between accounts from the sidebar, and run agents in the team with an authtoken of their own. Billing and the team stay with the owner and admins. Pay-as-you-go includes 3 seats.

devgate tcp 22 puts any TCP service on a public tcp:// address, and a reserved TCP endpoint keeps its port; devgate tls passes encrypted connections, by server name, to a service on your own domain that holds its own certificate. --cidr-allow and --cidr-deny, and a policy’s on_tcp_connect rules, decide who may connect. Both are rolling out on paid plans. Custom domains can also be wildcards now: *.example.com covers every subdomain.

devgate service install keeps the agent running across reboots — a systemd unit on Linux, a launchd agent on macOS, a Windows service — starting the endpoints in your config file; status, start, stop, restart and uninstall come with it. Without a terminal the agent now logs plain lines instead of drawing its screen,, and DEVGATE_WEB_ADDR moves the inspector to another address.

devgate http now takes ngrok’s --basic-auth, --cidr-allow and --cidr-deny, --verify-webhook, --ua-filter-allow and --ua-filter-deny and the four header flags; the agent writes them as Traffic Policy rules ahead of any policy file. The agent serves ngrok’s local API at http://127.0.0.1:4040/api — tunnels with their public URLs, starting and stopping tunnels, captured requests and replay. The new verify-webhook action checks Stripe, GitHub, Slack, Shopify, Twilio, Telegram, Paddle, Discord and other signatures at the edge.

Pay-as-you-go accounts can set a spending limit for usage past the included credit, and every plan gets e-mail alerts at 50, 80 and 100% of its credit; when a credit or limit runs out, cloud endpoints pause too. Annual Pay-as-you-go billing is 20% off. Client addresses seen by Traffic Policy can no longer be spoofed with X-Forwarded-For.

List endpoints in ~/.devgate/devgate.yml the way ngrok’s version 3 config does — name, url, upstream, traffic_policy, pooling_enabled — and devgate start web api or devgate start --all brings them online together. devgate config check validates the file, --config points at another one, and add-authtoken now keeps the rest of the file. The New Endpoint wizard shows each endpoint as a config entry too.

devgate http 3000 --traffic-policy-file policy.yml runs an ngrok-compatible Traffic Policy at the edge: basic auth, rate limits, redirects, URL rewrites, headers, IP rules and custom responses, with CEL expressions and ngrok’s variable names. Cloud endpoints are created in the dashboard and stay online with no agent; --url https://api.example.internal starts an internal endpoint they reach with forward-internal; --pooling-enabled load balances several agents on one URL. The New Endpoint wizard covers all of it, with a policy editor that checks your YAML as you type.

devgate http 3000 --url https://<your dev domain> starts the tunnel on the fixed hostname every account has under Domains, and its active hours are free; --url https:// alone means the dev domain. Flags take their value after a space as well as after =, and devgate http accepts an address such as myapp.test:8080. Domains → Start Endpoint walks through it and shows when the endpoint is online. Endpoint hours now count only hours that carried traffic, and a running tunnel stops once a Free or Hobby credit is spent.

The running agent serves http://127.0.0.1:4040 with every request it forwards in full — the request and response headers and bodies — and replays a request to your local service as it was or after editing its method, path, headers or body. Everything stays on your machine, in memory; --inspect=false turns it off.

Turn on full capture in account settings and Traffic Inspector keeps each request’s and response’s headers and the first 10 KB of each body — for 24 hours on Free and 72 on paid plans — and replays a captured request into its tunnel with one click. It is off by default, as on ngrok.

On the free plan a browser opening a tunnel first sees a short devgate page with a Visit site button, once a week per visitor; webhooks and API clients never see it, and the devgate-skip-browser-warning header turns it off. Brand names can no longer be used in usernames, endpoint names or domains, and phishing on a tunnel can be reported at devgate.online/abuse.

On Windows the agent installs from the Microsoft Store, or with winget install devgate -s msstore: signed by Microsoft, kept up to date by the Store, and on PATH as devgate in every terminal.

Windows 10 and 11 on x64 and ARM64: the download page has a zip holding a single devgate.exe, and Ctrl+U updates it in place. On Windows the agent then asks to be started again instead of restarting itself.

Every tunnel hostname now answers /robots.txt with Disallow and sends X-Robots-Tag: noindex, so a development server exposed through devgate is not crawled or indexed, and crawlers do not spend its metered traffic.

The tunnel server now grants every device key exactly the ports its account holds — its reserved endpoints and its live sessions — instead of the whole pool. The agent reconnects on its own when a re-registered session moves to a new port.

Two guides — serving a named local vhost, and how devgate compares to ngrok — plus about, contact, changelog, terms and privacy pages, and a machine-readable security contact. The feature list on the home page now tracks exactly what ships in the current release; roadmap items get an entry here when they land.

The running agent now prints every request it forwards — method, path, status, duration, size — with connection counters (open, total, per-second rates, connection-lifetime percentiles) above them.

--host-header lands, so a named local site (Herd, Valet, docker, nginx server_name) can be served as itself. The marketing site moved to the apex and the app to dashboard.devgate.online.

Stripe integration behind a provider-agnostic seam: plans, monthly usage credit, metered overage beyond it, and invoices in the dashboard.

An onboarding wizard for new accounts, admin invitations, trial handling, and the domains section in the dashboard.

Endpoint hours, transfer and requests are metered from the agent heartbeat and totalled per billing cycle.

Ctrl+U updates the agent in place, verifying the download against a SHA256 manifest before replacing the binary. install.sh stops needing sudo and defaults to a user-writable directory.

CI publishes immutable per-version tarballs and a checksum manifest; the tap installs from them.

devgate.online goes live: the Go agent, per-device keys, reserved and ephemeral endpoints, and the tunnel router.