FAQ

Do viewers install anything?

No. They open a link in any browser, enter a code from their inbox, and use the app. Only TCP services through the command line need the houseguest binary; SSH also works in the browser.

Does Houseguest replace my app’s sign-in?

No. It decides who may reach the app at all. Your app’s own login, roles and data stay exactly as they are.

What does it need from my network?

Outbound HTTPS (port 443) from the host running the agent, and an app served over HTTPS. The agent checks the app’s certificate against public roots or your internal CA. On the app’s own hostnames, public DNS points each shared name at the edge while inside your network the same names keep resolving to the app. Houseguest™ addresses need no DNS changes at all.

My app uses several hostnames. Will it work?

That is what Houseguest is for. A preview covers several hostnames with one sign-in, and the app keeps its real names, so its cookies, redirects and cross-origin calls behave as they do on your network. The hostnames must share a parent domain.

What if someone forwards the link?

An invite works once and, by default, only with a code sent to the invited address. With standing access, the code goes only to addresses on the list.

Can I change what is shared while a preview is open?

Yes. Add or remove a hostname, add or remove people, extend the end, or end it, all from the console and all effective at once.

Does it work for SSH or a database?

Yes. A preview can include TCP services that the agent’s host lists by exact name and port. SSH opens in a browser terminal, which the edge runs. The houseguest command line carries any TCP service through the edge without interpreting it. Encrypted protocols such as SSH or a database over TLS stay encrypted end to end; a protocol without encryption, such as plain HTTP or an unencrypted database connection, is readable at the edge. See TCP and SSH.

What can Houseguest itself see?

The edge terminates TLS so it can check each request, so the hosted edge sees preview traffic while a preview is open. For each request the request log stores the time, the person, the method, hostname and path, the result, and the browser family and OS, device type and country. The edge’s web-server log also records the client IP address, the request line and request headers such as the user agent. Neither keeps query strings or bodies. If no third party may see the traffic, the self-hosted edition runs the edge on your own server, on the Enterprise plan.

Will my internal hostnames become public?

On the app’s own hostnames, yes: each shared name gets a public DNS record and a public certificate, which is listed in Certificate Transparency logs. The app itself stays unreachable except through an open preview. If the names must stay private, use Houseguest addresses.

Is anything reachable when nothing is shared?

No. A hostname answers “No preview is open here” unless a preview lists it, and the agent forwards only its own allow-list.

Can the app tell who the viewer is?

Not from Houseguest: it does not pass the viewer’s identity to the app. The app relies on its own login.

How long does setup take?

About 15 minutes for an admin: verify a domain, run one container, point DNS. With Houseguest addresses you skip the DNS. Opening a preview after that takes a minute.