Weave Code
Expose Laravel Package
beyondcode/expose
Expose by BeyondCode shares local Laravel or PHP sites through secure public URLs. Create tunnels, use custom domains, inspect requests, and test webhooks or mobile apps without deploying.
Expose is a PHP package by Beyond Code that creates secure public tunnels to your local applications, letting you share a development site with clients, teammates, or webhooks without deploying or configuring DNS. It provides an elegant CLI with a built-in dashboard showing incoming requests in real time, making it a popular alternative to ngrok for PHP and Laravel developers.
- Share local sites instantly via a public URL
- Real-time request dashboard with response inspection
- Custom subdomains and shared-server mode
- Zero-configuration setup with a single command
Frequently asked questions about Expose
- What is beyondcode/expose used for in a Laravel project?
- Expose creates a public HTTPS URL that tunnels to a local site or port so you can share work in progress with clients, test provider webhooks, and watch incoming requests in real time. It runs as a standalone CLI sidecar rather than an application dependency, so nothing is added to your app code, config, service providers, or container image. The package ships with first-class Laravel integration and a free hosted service.
- How do I install and run expose for Laravel?
- Install it globally with Composer (composer global require beyondcode/expose) or use the PHAR, Homebrew, or Docker distribution, all of which keep it inside an existing PHP toolchain. Authenticate once with expose auth token, then run expose share localhost:8000 or expose share myapp.test to get a public HTTPS URL. Time to first value is roughly five minutes.
- Does expose work with Laravel Valet, Herd, and Sail?
- Yes. With Valet or Herd, share the site hostname rather than the port (expose share myapp.test) so Host-dependent routing and tenant resolution behave the same way they do locally. With Sail or Docker Compose, run the Expose client on the host against the published container port. It also works alongside artisan serve.
- Can I use expose as production ingress?
- No. Expose belongs in the developer-tooling and test-harness layer and should never be scoped as production ingress. Adopting it adds a new network path and a new trust boundary, because requests traversing the tunnel leave your machine and pass through a relay. Use it for local development, demos, and webhook testing only.
- How do I test Stripe or GitHub webhooks locally with expose?
- Start the tunnel to your local app, then point the provider's test webhook endpoint at the public HTTPS URL Expose gives you and fire an event. Confirm the payload lands in storage/logs/laravel.log or your configured logging channel. This webhook loop is the recommended one-day proof because it has a binary success criterion. Remember that free-tier subdomains rotate per run, so recurring webhooks need a reserved subdomain.
- Why are my Laravel redirects, login, or signed URLs broken through the tunnel?
- This is usually configuration rather than a bug: set APP_URL, and SESSION_DOMAIN where relevant, to the tunnel host so generated links, redirects, and sessions stay on the public domain. Also note that release 3.2.4 stopped sending the default port in the Host header, which changes behavior for TrustHosts allowlists, Route::domain(), tenant resolution from host, and signed URLs where the host participates in the signature. Regression test those paths before rollout and keep 3.2.3 pinned as a one-cycle fallback.
- Does expose support signed URLs and multi-tenant host resolution?
- Host fidelity is load-bearing for URL::signedRoute(), temporarySignedRoute(), Route::domain(), TrustHosts allowlists, and tenant resolution from the host, so verify each of these against the tunnel. Expose relays the Host header, but 3.2.4 changed how the default port is sent, which can alter observable behavior for host-dependent logic. If host fidelity matters in your apps, treat the 3.2.4 regression test as a release gate.
- How do I get a stable subdomain for recurring webhooks or OAuth callbacks?
- Free-tier subdomains rotate on every run, and the real cost is re-pointing provider webhooks and re-registering OAuth callbacks rather than latency. Reserve a subdomain through the hosted service, or self-host with your own wildcard DNS, for any workflow that recurs. Treat the reserved subdomain as a budget line rather than a technical detail.
- Is expose secure, and what happens to my traffic?
- The client runs as a separate process and relays traffic to your local port or hostname, so any request crossing the tunnel leaves your machine and passes through either a third-party relay or one you operate. Treat the auth token as a credential: pin versions, verify PHAR checksums during provisioning, and revoke tokens at offboarding. Check whether security, compliance, or customer contracts permit webhook payloads to traverse a third-party relay, because if not, self-hosting is required.
- How does expose compare to ngrok, and can I self-host the server?
- Expose is PHP-native, so it fits an existing Composer toolchain without adding Node or Go, and a single language-agnostic CLI suits polyglot teams. It is open source, so you can self-host the relay, but that shifts wildcard DNS, certificate renewal, patch cadence, and on-call onto your team. Compare licence savings against engineering hours explicitly, because per-seat ngrok and a self-hosted Expose are not comparable on a spreadsheet otherwise.
Weaver
How can I help you explore Laravel packages today?