Expose puts a site that runs on your computer on a public URL — for a client demo, a webhook from a payment provider,
or a test on your phone. The tunnel goes from the provider to your computer through DevCatz’s proxy, so the site sees its own
Host header: routing, cookies and Vite HMR work just as they do locally. Expose works the same on macOS and Windows.
Providers
| Provider | Account | The URL you get |
|---|---|---|
| Cloudflare quick tunnel | None | A random https://….trycloudflare.com per share, meant for short-lived sharing |
| Your Cloudflare domain | Your Cloudflare account (Log in to Cloudflare) | A fixed hostname on one of your zones, such as demo.example.com. DevCatz creates the named tunnel and its DNS record; the certificate lives in ~/.cloudflared%USERPROFILE%\.cloudflared. |
| ngrok | An ngrok authtoken | Your ngrok URL — random, or a reserved domain. The free plan allows one agent at a time. |
| Expose (expose.dev) | An Expose token | A subdomain on sharedwithexpose.com, or your own Expose server. Needs PHP 8.2 or later. |
For Your Cloudflare domain, the DNS record for the hostname you pick is created — or overwritten — on the zone you logged in with. Pick a name that is not in use.
Tunnel tools
Each provider needs its tool: cloudflared, ngrok or Expose. The Expose page lists them under Tunnel tools with Install, Uninstall… and Check for updates, and says where each comes from. cloudflared is installed for you the first time you share a site with Cloudflare.
| Tool | Where it comes from |
|---|---|
| cloudflared | GitHub (cloudflare/cloudflared), SHA-256 checked — the macOS tarballcloudflared-windows-amd64.exe |
| ngrok | ngrok’s download server; ngrok publishes no checksums, so the URL and SHA-256 come from the Homebrew caskScoop’s manifest |
| Expose | GitHub (exposedev/expose), the phar build; runs on the PHP of the Runtimes page |
ngrok and Microsoft Defender. Windows Security may flag ngrok as potentially unwanted software and quarantine it the moment it lands. DevCatz then stops with Windows Security (Microsoft Defender) blocked ngrok as potentially unwanted software, so it cannot be used and tells you the way round: Windows Security → Virus & threat protection → Protection history → Allow, then install again. Cloudflare needs no exception.
Updates are checked every six hours. A tool is swapped in place; shares running on it stop first.
Share a site
Press Share in a site’s header, or + / Share a site… on the Expose page. The dialog asks for:
| Field | What it does |
|---|---|
| Provider | One of the four above. Cloudflare domain asks for a Public hostname on your zone; ngrok for an optional Reserved domain; Expose for an optional Subdomain or custom domain. |
| Domain to share | For sites with several apps: which app’s domain goes public |
| Basic auth (optional) | A username and password in front of the share |
| Stops by itself after | Never (until you stop it), 30 minutes, 1 hour, 4 hours or 24 hours — so a forgotten share does not stay open |
DevCatz starts the site’s dev server first if it is not running, and the share only goes live once its hostname resolves. If you cancel while it starts, nothing is left running.
Laravel tip: set APP_URL to the public URL (or trust proxies) so absolute links point there.
Once it is live, the site header shows Shared with a public URL chip (public · click to copy).
The Expose page
Under Shared sites every share has its Public URL, a QR code for your phone, Copy URL, Open, Open site and Stop sharing.
The request inspector
Every request that comes through a share is listed live, newest first:
- method, status, path, time and the caller’s IP,
- request and response headers and bodies (up to 64 KB each), each with Copy,
- Replay sends a request to the site again — perfect for a webhook after you changed the handler,
- curl copies the request as a curl command,
- Clear empties the list and Hide assets leaves out requests for static files,
- ✦ Handle with AI explains who sent a request and what it means, and drafts a handler for the site (when AI and its Webhooks (Expose) feature are on).
Settings → Expose
| Option | What it does |
|---|---|
| New shares stop by themselves after | The default expiry for new shares. Each share can still pick its own. |
| Your Cloudflare domain | Log in or out of your Cloudflare account |
| ngrok | Authtoken and Reserved domain (optional) |
| Expose (expose.dev) | Token, Server (optional) — such as eu-1 or your own server — and Subdomain (optional) |
Cloudflare quick tunnels need no account. The other providers’ tokens are stored encrypted in the macOS KeychainWindows’ protected storage (DPAPI). Forget account removes one.
In the menu bar
The Shared sites submenu of the menu bar icon (the system tray on Windows) lists each share with Copy URL, Open, Requests… and Stop sharing. See Monitoring and the menu bar.
Good to know
- A share makes your local site reachable from the internet. Use Basic auth for anything that is not meant to be public, and an expiry for demos.
- Requests reach your computer only while DevCatz and the share are running.
Last updated 2026-11-01