Password Protection

Password protection adds HTTP Basic authentication in front of an HTTP tunnel. It is available on paid plans and is separate from the credential used to connect the CLI.

Start a protected tunnel

outray 3000 --password "$PREVIEW_PASSWORD"

Use an ASCII password. Visitors enter the password in their browser's login dialog; the username is ignored.

When credentials are missing or incorrect, OutRay returns 401 Unauthorized with a Basic authentication challenge. Requests with the correct password are forwarded to your local application.

Call it from a client

Use your actual tunnel URL:

curl --user ":$PREVIEW_PASSWORD" https://preview.example.com/api/health

A webhook provider must support sending Basic credentials to use a protected endpoint. Otherwise, authenticate the webhook in your application using the provider's signature verification.

Configuration file

[tunnel.preview]
protocol = "http"
local_port = 3000
password = "replace-with-a-private-preview-password"

Then run outray start. The TOML parser treats this as a literal value: it does not interpolate environment variables. Keep a password-bearing config out of source control.

Security boundaries

Use HTTPS when sending credentials. Basic authentication encodes a password; it does not encrypt it by itself.

--password protects the HTTP request forwarding path, not TCP or UDP services. WebSocket upgrade traffic follows a separate path and is not protected by this password check; require application-level authentication for WebSocket endpoints.

A shared preview password is not a substitute for user accounts, authorization, rate limiting, or application authentication. Tokens and passwords supplied as CLI arguments may also be visible in process listings on the local machine.