Documentation
Ephemeral Tunnels
Give an app on your development machine a temporary public HTTPS URL. Nouva uses the OpenSSH client already on your computer, so there is no tunnel client, access token, or SSH key to install.
When to use a tunnel
Tunnels are designed for temporary development and testing. Use them to receive webhooks, test OAuth callbacks, share work in progress, or let a remote service reach an HTTP server running on your computer. The public route exists only while your SSH connection is open.
Good fit
Not a production host
Before you connect
- A free Nouva account signed in with GitHub.
- Stock OpenSSH, available as the
sshcommand on your computer. - A local HTTP application that is already listening on the port you want to expose.
- Outbound access to
ssh.nouva.cloudon TCP port 22.
Open the Tunnels dashboard to build commands for up to five local ports and see the published SSH host fingerprint.
Create your first tunnel
Replace 3000 with the port used by your local application. Port 0 asks Nouva to generate a random public hostname.
ssh -R 0:localhost:3000 tunnel@ssh.nouva.cloudTo request an exact alias, put the label before :80. This example publishes https://my-app.nouva.cloud.
ssh -R my-app:80:localhost:3000 tunnel@ssh.nouva.cloudKeep this terminal open. Press Ctrl-C or q to stop the session and remove its public routes.
Authorize the SSH session
- Run the SSH command.
- Open the one-use authorization link printed in your terminal.
- Sign in with GitHub if needed, choose a workspace, and approve the connection.
- Return to the terminal. It continues automatically and prints every public URL.
The link expires after five minutes and is bound to that SSH connection. If it expires or the connection closes, run the SSH command again to create a new link.
Expose multiple local ports
Repeat -R in one command to expose multiple services through the same SSH session. A connection can create up to five forwards, subject to the workspace limit.
ssh -R api:80:localhost:3000 -R web:80:localhost:5173 tunnel@ssh.nouva.cloudEach forward gets its own HTTPS URL, traffic history, capture setting, and usage totals. If one local target stops, requests to that forward return 502 without closing the other forwards.
A single SSH connection can authorize at most 100 forwards over its lifetime, including forwards you later cancel. This does not affect normal five-forward sessions. If you repeatedly add and cancel forwards while experimenting, reconnect to start a new session.
Generated hostnames and custom aliases
Generated hostnames start with t- and use a random label. They are not deliberately reused.
Custom aliases must contain 3 to 40 lowercase letters, numbers, or internal hyphens. Labels beginning with t-, infrastructure names, protected names, and administratively reserved labels cannot be claimed.
An alias is first-come while connected. After disconnect, the route disappears and the alias enters a 24-hour quarantine. During that period, only the same GitHub user can reclaim it. Reconnecting and disconnecting restarts the quarantine window.
Terminal status and dashboard
Once approved, the terminal shows the session ID, public URLs, inspector link, connection time, and a live request list with method, path, status, duration, size, and forward. The dashboard shows the same live sessions, workspace usage, recent session metadata, capture controls, and a disconnect action.
Inspect and replay traffic
Nouva stores request metadata for seven days. Metadata includes the method, path without its query string, status, duration, source IP, sizes, and content types.
Full request and response capture is off by default. The session creator can enable it separately for each live forward. Capture files are encrypted at rest and retained for seven days. The inspector lists the latest 100 metadata entries for a forward, while encrypted payload files use FIFO storage caps of 100 per forward and 500 per workspace. Capture stores up to 64 KiB for each request and response body, 32 KiB of headers in each direction, and an 8 KiB URL. Truncation or capture-storage failure never stops forwarding.
Authorization values, cookies, API keys, passwords, tokens, signatures, and similar secrets are masked by default when the inspector renders them. The raw captured values remain encrypted at rest. Revealing a secret creates an audit event, so do not enable capture for sensitive data you should not retain. Only the user who authorized the SSH session can inspect payloads, reveal secrets, delete captures, or replay them. Workspace administrators can disconnect a session but cannot read captures.
Exact Replay and Edit & Replay are available only for complete captures while the original SSH session is still live. Nouva asks for confirmation before replaying a non-idempotent method. Replay is limited to 10 requests per minute per user and 100 per day per workspace, and replay traffic counts toward fair use. WebSocket frames are not captured; only handshake metadata is retained.
Supported traffic
Supported in V1
Not supported in V1
Request behavior
Nouva preserves the original HTTP method, path, query, streaming request body, response, and public Host. It removes hop-by-hop headers and replaces forwarded client headers with values from Nouva's trusted edge. Failed requests are never retried.
Tunnel responses are private, uncached, and marked for search engines not to index or archive. A proxied Set-Cookie header may be host-only or scoped to the exact tunnel hostname. Cookies scoped to a parent domain such as .nouva.cloud are dropped.
Fair-use limits
Every GitHub-authenticated user gets the same free service. At 80 percent of a rolling allowance, Nouva shows a warning. At the limit, the SSH connection stays open while new requests receive 429 until usage falls below the rolling window. Traffic rejected at the edge does not consume workspace quotas.
| Limit | Free V1 allowance |
|---|---|
| Live forwards | 5 per workspace |
| SSH connections | 3 per user, 5 per workspace |
| Transfer | 5 GiB / 24h, 25 GiB / 30d per workspace |
| Requests | 50,000 / 24h, 250,000 / 30d per workspace |
| Request rate | 60 req/s sustained, burst 120 per forward |
| In flight | 100 per forward, 250 per workspace |
| Request body | 25 MiB |
| Response body | 100 MiB |
| URL / headers | 8 KiB / 32 KiB |
| Ordinary HTTP lifetime | 90 seconds |
| WebSocket / SSE | No fixed lifetime; 30-minute no-byte timeout |
| SSH lifetime | Unlimited while keepalives succeed |
| SSH liveness | Disconnect after three missed 30-second keepalives |
SSH host verification
On your first connection, OpenSSH asks whether you trust ssh.nouva.cloud. This is normal. Compare the Ed25519 fingerprint in the prompt with the fingerprint published on the public tunnel page or in the Tunnels dashboard before accepting it. OpenSSH stores the accepted key in your known_hosts file and normally does not ask again.
OpenSSH clients with ML-KEM support negotiate a hybrid post-quantum key exchange. Older compatible clients fall back to Curve25519. If a previously accepted fingerprint changes, stop and verify the published value instead of bypassing the warning.
Troubleshooting
| What you see | What to do |
|---|---|
| Hostname does not resolve | Check local DNS and retry ssh.nouva.cloud from another network. |
| Connection times out | Confirm your network permits outbound TCP port 22. |
| Authorization link expired | Run the SSH command again and approve the new one-use link within five minutes. |
| Alias is unavailable | Choose another valid alias, or use port 0 for a generated hostname. |
502 or local connect failure | Start the local app and verify that it is listening on the port in your -R option. |
429 | Keep SSH connected and wait for the rolling request or transfer window to clear. |
413, 414, or 431 | Reduce the request or ordinary response body, URL length, or headers to the published limit. |
503 | The hostname is unknown, disconnected, quarantined, or temporarily unavailable. |
Security and acceptable use
Every tunnel URL is public. Keep authentication enabled in your local app, expose only the routes required for testing, and avoid production secrets or personal data. Nouva adds no browser interstitial in front of healthy routes, so webhook providers and API clients can connect directly.