Architecture

OutRay has separate paths for tunnel traffic and application telemetry. They can be used together, but neither requires the other.

Tunnel forwarding

The CLI or a tunnel plugin opens an outbound WebSocket connection to the tunnel server. After authentication and address allocation, requests arriving at the public endpoint are routed to that connected client.

For HTTP, the server sends the request method, path, headers, and body through the WebSocket connection. The local client makes an HTTP request to localhost and returns the response through the same connection.

WebSocket upgrades are relayed separately through the HTTP tunnel. TCP and UDP clients forward bytes or datagrams to a local socket service instead.

The process must stay connected for the public endpoint to reach the local service. Reserving an address does not turn a local application into a hosted deployment.

Observability ingestion

An observability SDK runs inside the application and exports traces, logs, and metrics over OTLP/HTTP to https://ingest.outray.co.

This path uses a token with observability:write. It does not need a public tunnel URL. Framework instrumentation can describe requests served locally, through a tunnel, or by an independently deployed application.

Tunnel request capture records data from the public proxy path. SDK payload capture adds bounded, redacted attributes to application spans. They are separate capture systems with different controls and privacy characteristics.

Control plane

The web console manages organizations, member roles, tokens, subscriptions, tunnel addresses, observability views, Secrets vaults, and Uptime monitors.

The CLI's browser login and Secrets API use https://outray.co; the tunnel connection uses wss://connect.outray.co/. The console's Tunnels workspace is under /<org-slug>/tunnel.

Security boundaries

Hosted HTTP visitors use HTTPS and hosted clients use a TLS-protected WebSocket, but TLS terminates at the platform. This is not end-to-end encryption that hides proxied HTTP payloads from OutRay.

The local HTTP hop is unencrypted loopback HTTP. TCP/UDP visitors need service-level encryption if their protocol requires it.

Authentication of the tunnel client determines resource ownership and permissions. It does not add application authorization for visitors. Use HTTP password protection where appropriate and keep service-level authentication enabled.

Continue with Tunnels, Observability, or the CLI reference.