Documentation

Get one local service onto a public URL.

Target: five minutes. If it takes you longer, that is a bug in this page or in the product, and we would like to hear which.

Not all of this works yet. Steps 2 and 3 are waiting on Connector registration, and each step below says plainly whether it is live. Nothing here describes a screen that does not exist.

Before you start

You need:

• a service already running and reachable on the machine you will install on — try curl http://127.0.0.1:8080 first, and fix that before continuing;
• an account (sign in from the landing page — there is no separate login URL);
• one of the seven supported platforms:

1. Sign in — live

Go to the landing page and use Sign in. Either Google, or a six-digit code sent to your email address. There is no password anywhere in the product, so there is nothing to forget, leak or rotate.

Your first sign-in creates a Workspace for you automatically, with you as its Owner and on the Free plan. You are not asked to name anything.

A Workspace is the billing, membership and policy boundary. Everything you create belongs to exactly one, and workspaces cannot see each other.

2. Install a Connector — not available yet

The install page is at Connectors in the console. It shows the command for each platform, but the enrollment tokens the command needs cannot be issued yet, so the install will not complete.

When it does work, you will get two forms of the command, and you should prefer the second if you are at all careful:

# one line
curl -fsSL https://<host>/install.sh | VIASTEAD_TOKEN=<token> sh

# or download it, read it, then run it
curl -fsSL https://<host>/install.sh -o install.sh
less install.sh
VIASTEAD_TOKEN=<token> sh install.sh

The one-liner asks you to run code you have not read. The second form exists so that declining to do that is a supported path rather than something you have to improvise.

Three things the installer guarantees, and why each matters:

• A truncated download does nothing. The whole script is wrapped in a function that is only called on the very last line. If your connection drops halfway, you get an incomplete file that defines a function and exits — rather than half an installation.
• The binary's checksum is verified before it runs, by default, not behind a flag you have to remember.
• You can pin a version, so a fleet stays on a known build instead of tracking whatever is newest.

3. Approve the machine — not available yet

A newly installed Connector reports in as pending. It carries no traffic until somebody approves it.

The console shows its machine fingerprint, Site, version and source IP. Check those against the machine you just installed on before approving — that comparison is the entire security value of this step. A token that leaked would produce a pending Connector that looks almost right, and the fingerprint is how you tell.

Who can do what:

An Operator can hand out tokens and take a misbehaving machine out of service, but cannot admit a new machine to the workspace. That split is deliberate.

4. Expose a Service — live in the console, but you cannot reach step 2 yet

You point an Endpoint at a local address, and confirm once.

The confirmation says exactly what you are about to do — "you are about to expose 127.0.0.1:8080 to the public internet at https://…" — and until you confirm, the Endpoint stays a draft with no public address at all. It is asked once, on whichever side you are already using; the other side shows the event but does not ask again.

Some addresses are refused:

• Cloud metadata endpoints (169.254.169.254, fd00:ec2::254, metadata.google.internal) are refused with no override on any plan. Those addresses hand out your instance's credentials to anything that can reach them, so exposing one would turn your tunnel into a credential leak.
• LAN addresses need a paid plan and have to be switched on deliberately. Loopback (127.0.0.1, ::1) works everywhere with no extra setting.
• The Connector's own inspector port, which would publish the agent's control surface through the tunnel it is running.

5. Choose who can reach it — live

Access Policy is the second step of creating an Endpoint, not a setting buried somewhere you might never visit. The options are Public, Passcode, IP allowlist, OAuth via Google or GitHub, and Consent-only.

With Consent-only you invite a named person from the endpoint itself; they accept, and they decide how long the access lasts. It always expires.

What you get either way

Free includes 1 GB of traffic a month and automatic TLS. Security is not paywalled: automatic TLS, passcodes, IP allowlists, token revocation and abuse handling are all on Free too.

If you go far enough over your allowance, traffic is suspended rather than billed silently. The FAQ covers what that means in practice.

If it did not work

• The install command does nothing / says the host is unknown — expected today. See step 2.
• You signed in but the console says your workspace setup is incomplete — workspace creation failed without failing your login, on purpose. Use the retry on that page; your account and billing are unaffected.
• curl http://127.0.0.1:8080 fails on the machine itself — that is not a viastead problem yet. Fix it locally first; nothing downstream can work until it does.