1. Set up a tunnel

1. Create a key. Give it a name, and optionally a subdomain (leave it blank for a random one). Add one HTTP forward (your local port) and/or TCP forwards. TCP forwards get a public sapper.sh port automatically, and the dashboard shows it while the tunnel is live.
2. The key file downloads to your Downloads folder as sapper-<name>-<id>.key. Keep it private. It is your login for this tunnel.
3. Switch the key on.

2. Connect

1. Start your app on the local port you set, for example localhost:3000.
2. Click Command, then Copy, and paste it into a terminal on the lab machine (Mac or Linux). It stays running until you press Ctrl-C.
3. The key shows LIVE once sish reports the connection. This can take up to a minute after you switch it on.
4. Open your address, https://<subdomain>.sapper.sh. Visitors first see a short warning page and click Continue to the site.

3. Status and buttons

• LIVE: connected. DOWN: switched on, but not connected. The command isn't running, or the lab machine can't reach sapper.sh.
• STOPPING: switched off, and the connection ends within about 15 seconds. OFF: switched off and disconnected. EXPIRED: past its expiry date. Change it under Edit.
• New key file makes a new key and replaces the old one, which stops working at once. Use it if the file is lost or you want a fresh key.
• Agent script is an advanced option that runs and keeps the tunnel up for you. Don't use it together with the Command on the same machine.

4. Troubleshooting

Permission denied (publickey)

The server doesn't accept the key file. Check that the file is in Downloads with the exact name the Command uses. Browsers add (1) if an old copy is still there, so delete the old one. If you made a new key file, use only the newest one. If the key is switched off or expired, the server refuses it too.

UNPROTECTED PRIVATE KEY FILE

ssh refuses key files that others can read. The Command sets this for you. If you run ssh by hand, first run chmod 600 ~/Downloads/<file>.

Key shows DOWN after you switch it on

Paste the Command again and watch the terminal for errors. Make sure your local app is running on the port you set.

Connect failed or connection refused in the terminal

Nothing is listening on the local port. Start your app, then wait. The Command retries every 15 seconds.

The tunnel drops now and then

The Command reconnects by itself after a drop, every 15 seconds. Frequent drops usually point to an unstable network connection.

Subdomain or TCP port already taken

Choose another subdomain, or leave it blank for a random one. TCP ports are assigned automatically, so there's nothing to change there.

Visitors see a warning page

This is intentional. Every free or unreviewed tunnel shows a short page first, so visitors know it isn't sapper.sh itself. They click Continue and reach your app. Tools that call your address directly, such as webhooks, need to send the same cookie or will get the warning page.

Operation is not supported when creating a key

Your browser can't make Ed25519 keys. Creating a key then falls back to ECDSA. If it still fails, reload the page and try again, or use a current version of your browser.

Copy didn't work

Select the command text and copy it by hand.

Windows

The Command needs a Unix shell. Run it in WSL or on a Mac or Linux machine.

Reset SSH key

You shouldn't need it for keys made here. Use New key file instead.