curl, a browser, a database driver, an existing library that only knows how to dial a socket. forward() publishes the tunnel on a local address so all of them just work.
Prerequisites
- An API key from the console, exported as
BOXLITE_API_KEY. See API keys. pip install boxlite, and the REST URL exported asBOXLITE_REST_URL. See Quickstart.- A box you can start, and a service inside it that listens on a TCP port.
- The box must be created with inbound enabled. A tunnel against a private
box is refused, and inbound has defaulted to
disabledsince 0.10.5 — see Network policy.
Publish a box port on your machine
- CLI
- SDK
One command, and it stays in the foreground forwarding until you stop it:Reach for this when you just need the port open while you work — no script to write,
nothing to clean up. Flags are on the CLI reference.
Choose the listening address
Three constraints, each of which raises rather than failing quietly:- The host must be a numeric IP.
SocketAddress.tcp(host="localhost")raisesValueError: tunnel listener host must be a numeric IP— pass"127.0.0.1". port=0is the default and asks the operating system for a free port. Read the port you actually got fromforwarder.local_addr().port.- A Unix socket path must be absolute.
SocketAddress.unix("relative.sock")raisesValueError: tunnel Unix socket path must be absolute.
Keep it running, and shut it down
await forwarder.wait() blocks until the forwarder finishes — that is what a
long-running process awaits instead of exiting. await forwarder.close() shuts it down.
Next steps
Network
How tunnels work, the full parameter reference, and the outbound boundary.
Network policy
Control what the box itself is allowed to reach.

