Hosted Proxy
Point one of your domains at any public URL and we forward the traffic from the edge. No CLI to install, and no terminal left running overnight.
Why it exists
The ProxyLens CLI exists to reach servers we cannot: something on localhost, or behind your office firewall. That is a real constraint, and a tunnel is the only way across it.
When your target is already a public URL, that constraint disappears. A staging API, a third-party service you want to watch, a webhook receiver already deployed — our edge can reach all of them directly. Hosted proxy skips the tunnel entirely, which means the domain keeps serving whether or not your laptop is open.
One hop fewer, and nothing on your machine to keep alive.
Which mode should I use?
| Your target is | Use | Why |
|---|---|---|
| localhost:3000 | CLI Tunnel | Only your machine can reach it. |
| A server on a private network | CLI Tunnel | The tunnel is what crosses the firewall. |
| https://staging.you.com | Hosted Proxy | Already public, so no tunnel is needed. |
| A webhook receiver you want to watch around the clock | Hosted Proxy | Keeps running with nothing open on your desk. |
| A third-party API you want to inspect | Hosted Proxy | You do not control it, so you cannot run a CLI beside it. |
The choice is per domain and you can switch at any time — the inspector, replay and flow recording work identically either way.
Setting it up
Pick a domain
Open Dashboard → Domains and register one, or use a domain you already have. Any type works: a free .proxylens.dev subdomain, a generated one, or your own custom domain.
Set the traffic source
Click the icon on the domain row, choose Hosted URL, and enter your target.
A path is allowed and becomes a prefix, so a target of https://api.your-company.com/v1 turns an incoming request for /users into /v1/users. Query strings and fragments in the target are ignored — those come from the incoming request.
It is live
There is no third step. The change takes effect on the next request.
Open the inspector to watch it live. Requests through a hosted proxy look exactly like tunnelled ones — same timeline, same replay, same WebSocket transcripts.
What reaches your server
The method, path, query string and body are passed through untouched. Headers are adjusted so your origin sees a well-formed request rather than a replay of our edge.
| Header | What we do |
|---|---|
| X-Forwarded-For | Set to the visitor's IP address. |
| X-Forwarded-Host | Set to the ProxyLens domain the request arrived on. |
| X-Forwarded-Proto | Set to the incoming scheme. |
| Host | Rewritten to your target's host, so virtual hosting works. |
| CF-*, CDN-Loop | Removed. An origin that also sits behind Cloudflare rejects requests that arrive with these already set. |
| Everything else | Forwarded as sent, including cookies and authorization. |
A 301 or 302 from your server is handed to the visitor rather than followed at the edge, so redirect chains behave as they would without us.
Bodies are streamed to the visitor as they arrive. Large downloads are not buffered waiting on the inspector, which records its own copy in parallel.
WebSockets
WebSocket upgrades are proxied too. We open a matching connection to your target and pipe frames in both directions, recording every one.
The transcript shows every frame in each direction with its size and timing, and you can inject a frame into a live connection from the inspector — useful for reproducing a client message without touching the client.
Restrictions
A hosted proxy makes our edge fetch a URL on a visitor's behalf, so some targets are refused when you save them rather than failing later.
- Private and loopback addresses
localhost, 10.x, 172.16–31.x, 192.168.x, 169.254.x and IPv6 equivalents. Our edge cannot reach your private network — that is what the CLI is for.
- Other ProxyLens domains
Pointing one hosted domain at another loops traffic through the edge. We refuse the target, and a loop that forms anyway is stopped at the second hop.
- Credentials in the URL
https://user:pass@host is rejected. Send authentication as a header instead.
- Non-HTTP schemes
Targets must be http:// or https://.
Availability
Hosted domains serve continuously rather than only while a CLI is attached, so they are metered separately from tunnels. Need more than three? Talk to us.