BORE
Next.js workflow6 minute setup

Expose a Local Next.js Server with a Public HTTPS URL

Keep next dev running exactly where it is and put a public HTTPS endpoint in front of it. Bore forwards requests from a reserved *.bore.dk namespace to your local port, so external services and devices can reach the app without opening your router or managing certificates.

Updated 2026-07-31 · Written by the Bore team

Step by step

From localhost to public HTTPS

01

Start the Next.js development server

Run the project normally and confirm it responds at http://localhost:3000 before adding a tunnel.

Terminal
pnpm dev
02

Install and authenticate Bore

Install the native client, then sign in through the browser flow. You only need to install once per machine.

Terminal
curl -sL https://bore.dk/install.sh | bash
bore login
03

Expose port 3000

Start the tunnel. Bore lets you reuse an available namespace or allocate a new one, then prints its public HTTPS URL.

Terminal
bore up 3000
04

Configure external callbacks

Use the full Bore origin and the real application path in OAuth, webhook, or preview settings. Keep secrets server-side.

Terminal
https://<namespace>.bore.dk/api/auth/callback
05

Stop or inspect the tunnel

List tunnel state whenever you need the URL. Stopping port 3000 removes the local claim but preserves its reserved namespace for reuse.

Terminal
bore ls
bore down 3000

Use cases

When a public Next.js development URL helps

A tunnel is useful when the caller cannot reach localhost: an OAuth provider returning to a callback, a webhook sender posting an event, a teammate reviewing a branch, or a phone testing the real responsive experience.

Bore terminates HTTPS at its public edge and relays HTTP and WebSocket traffic to the local app. Your Next.js process can remain a normal development server.

  • Test secure cookies and production-like redirect origins.
  • Open the same build from a phone without relying on a changing LAN address.
  • Share a temporary branch preview while your machine and tunnel are online.
  • Receive callbacks from services that require a public HTTPS destination.

Configuration

Treat the Bore hostname as an external origin

Set application base URLs, allowed callback URLs, and CORS rules to the exact HTTPS hostname Bore gives you. Do not replace every internal localhost URL: server-to-server dependencies on your machine can continue using localhost.

Environment variable names depend on your auth library and application. The example below is intentionally generic; use the setting documented by your provider.

.env.local
NEXT_PUBLIC_APP_ORIGIN=https://<namespace>.bore.dk
# Use your auth provider's documented callback/base URL variable.

Restart next dev after changing .env.local. Never put signing secrets in variables prefixed with NEXT_PUBLIC_.

Multiple ports

Keep a separate local API on a child hostname

If Next.js runs on port 3000 and a separate API runs on port 3001, reserve a child hostname under the same namespace. The root continues to use the main tunnel port while the child host uses its override.

Route api.<namespace>.bore.dk to port 3001
bore host add <namespace> api
bore host set-port <namespace> api 3001

Separate origins make CORS and cookie behavior more production-like. Add only the exact origins your API should accept.

Diagnostics

If the page opens but assets or callbacks fail

First open http://localhost:3000 on the development machine. A failing local request is an application issue; a working local request and failing public request narrows the problem to tunnel state, host validation, or provider configuration.

  • Run bore ls and confirm the namespace is active on the expected device and port.
  • Check the Next.js terminal for compilation errors and rejected host or origin messages.
  • Use the exact HTTPS callback path configured with the external provider.
  • Remember that the URL stops serving when the local app, Bore daemon, or machine is offline.

Common questions

Before you expose a port

Does Bore replace the Next.js development server?

No. Next.js still serves the application locally. Bore provides the public HTTPS endpoint and relays traffic to that local port.

Can I use Next.js hot reload through Bore?

Bore relays WebSocket upgrades, which Next.js development features use. If reload fails, check the browser console and Next.js host or origin restrictions for your version.

Is the public URL available when my laptop sleeps?

No. The namespace remains reserved, but requests need an online device, running local server, and connected Bore agent.

Should I expose a production database or admin route?

No. Treat the URL as internet-accessible. Use test data, keep credentials out of the client bundle, and do not expose development tools that assume a trusted network.

Sources and further reading

Continue reading

Run it locally

Put your Next.js branch on a real HTTPS URL

Create an account, authenticate the CLI, and expose port 3000 without changing how Next.js runs locally.

Get startedRead webhook setup