Skip to main content
Some clients cannot be taught to speak through an SDK — curl, a browser, a database driver, an existing library that only knows how to dial a socket. forward() publishes the tunnel on a local address so all of them just work.

Prerequisites

  • An API key from the console, exported as BOXLITE_API_KEY. See API keys.
  • pip install boxlite, and the REST URL exported as BOXLITE_REST_URL. See Quickstart.
  • A box you can start, and a service inside it that listens on a TCP port.
  • The box must be created with inbound enabled. A tunnel against a private box is refused, and inbound has defaulted to disabled since 0.10.5 — see Network policy.
Every example reads both values from the environment, so nothing hard-codes a credential.

Publish a box port on your machine

One command, and it stays in the foreground forwarding until you stop it:
Reach for this when you just need the port open while you work — no script to write, nothing to clean up. Flags are on the CLI reference.
The script below is the SDK path end to end — start a service in a box, forward it, and fetch it from the local address:

Choose the listening address

Three constraints, each of which raises rather than failing quietly:
  • The host must be a numeric IP. SocketAddress.tcp(host="localhost") raises ValueError: tunnel listener host must be a numeric IP — pass "127.0.0.1".
  • port=0 is the default and asks the operating system for a free port. Read the port you actually got from forwarder.local_addr().port.
  • A Unix socket path must be absolute. SocketAddress.unix("relative.sock") raises ValueError: tunnel Unix socket path must be absolute.

Keep it running, and shut it down

await forwarder.wait() blocks until the forwarder finishes — that is what a long-running process awaits instead of exiting. await forwarder.close() shuts it down.
forward() spends the tunnel it was built from. Build each forwarder from its own fresh await box.network.tunnel(port); reusing one will not work.

Next steps

Network

How tunnels work, the full parameter reference, and the outbound boundary.

Network policy

Control what the box itself is allowed to reach.