Skip to main content

​
Quick path

  1. Enter a Box:
  1. Inside the Box, start your app on an explicit port.
Your app must bind to 0.0.0.0. If it only listens on localhost or 127.0.0.1, the hosted HTTPS URL will not be able to reach it.
  1. Inside the Box, run this command to start hosting your app:
  1. Open the public HTTPS URL printed by host:
If the port is protected, the usable URL includes a _token query parameter:
A fresh host <port> URL is public unless you pass --private. If the same Box port was already hosted with protected access, it stays protected and the URL keeps its existing _token.
If you want the process to survive after your SSH command exits, start it as a detached process before hosting the port.

​
Host CLI reference

The host CLI runs inside a Box and exposes services from that Box on public HTTPS URLs.
The service you expose must listen on 0.0.0.0, not only on localhost or 127.0.0.1.

​
host <port>

Expose a running service on a stable HTTPS URL:
The command opens the firewall for that port, registers an HTTPS subdomain, and prints the URL. Calling it again for the same port returns the same URL. By default, a fresh host <port> command creates a public URL. Protected access starts when you pass --private, or when the same Box port already has a saved access token. That protection is sticky: hosting the same port again returns a URL with the same _token query parameter.

​
host list

Show hosted ports for the current Box:
Protected ports are shown as (gated). host list does not print the access token. Use host url <port> to print the full URL with _token=....

​
host url <port>

Wait until the HTTPS URL is ready, then print it:
For a protected port, this prints the full token-gated URL:
This is useful when one service needs another service’s public URL:

​
host hide <port>

Take down the public URL:
This closes public access and unregisters the HTTPS route. It does not stop the local server process. Stop the server separately when you are done. Access tokens are preserved, so hosting the same port again keeps existing protected links valid. To get an ungated URL after a port has become protected, host a different port that does not already have a saved access token.