Quickstart

On macOS, install with Homebrew — this keeps the agent up to date via brew upgrade devgate:

On Ubuntu or Debian, install with Apt — the agent then updates with the rest of your system, through apt upgrade:

On any other Linux, or on a Mac without Homebrew, use the install script, which picks the binary for your architecture and drops it on your PATH:

On Windows, install from the Microsoft Store — it keeps the agent up to date and puts devgate on your PATH — or the same package with WinGet:

A zip with a standalone devgate.exe is on the downloads page too.

Prefer a raw binary? Grab it from the downloads page and put it on your PATH yourself. Linux builds cover x86-64, 386, ARM64 and ARMv6.

Run this once. It stores your authtoken in the default config file so every tunnel is tied to your account:

Your authtoken is on your dashboard.

Point the agent at any local port. devgate prints a public HTTPS URL you can share instantly — it stays up as long as the command is running:

That URL is random and changes every run. Every account also has a fixed dev domain — find it under Domains — and --url puts the tunnel on it, exactly as with ngrok (--url https:// alone means your dev domain). Endpoints on the dev domain never accrue active hours.

Ephemeral tunnels get a fresh URL each run. For a stable address that survives restarts, reserve a static endpoint in the dashboard under Endpoints, then bring all your reserved endpoints online at once with a bare run:

Your plan caps how many endpoints you can reserve and keep online at once. See pricing for the limits per plan.

If your site is served as a named vhost — a Herd, Valet or docker setup you open at http://myapp.test rather than http://localhost:8080 — you need two flags, not one.

--host is where the agent connects. --host-header is what your service sees in the Host header. The agent forwards raw TCP and never rewrites Host , so without the second flag your vhost receives the public devgate hostname, fails to match its server_name, and answers with the wrong site or a 404.

rewrite sends whatever --host points at, adding :port when the port is not 80. When your service listens on loopback but answers to a vhost name, name it directly instead:

Wrong page, a 404, or “blocked request” through the tunnel? Local vhosts explained walks through every symptom.

Leave the flag off for a plain server on localhost. Passing the public hostname through is the default, and it is what an app generating absolute URLs, redirects or e-mail links needs. The same setting is editable per endpoint in the dashboard under Endpoints.

While the agent runs, open http://127.0.0.1:4040: every request it forwards, with the request and response headers and bodies. Replay sends a request to your local service again — handy for a webhook you are debugging — and Edit & replay changes its method, path, headers or body first. It stays on your machine, in memory; start the agent with --inspect=false to turn it off.

The dashboard's Traffic Inspector lists the same requests from every device. Turn on full capture in account settings and it also keeps their headers and the first 10 KB of each body — 24 hours on Free, 72 on paid plans — and replays them through the tunnel.

On the free plan, a visitor who opens your tunnel in a browser first sees a short devgate page saying the site runs on someone's own computer, with a Visit site button. It comes back once a week per visitor. It is there so a phishing page cannot pass itself off as devgate; paid plans don't show it.

Webhooks, API clients, curl and your page's own fetch and websocket calls never see it — only a browser opening a page does. To skip it from a browser or a script, send the header below with any value: