All articles
Use PortPreview with Express.js for HTTPS tunnels, webhooks, and OAuth
dev stacksExpress.jsNode.jslocal developmentlocalhost tunneling

How to Use PortPreview with an Express.js App

To use PortPreview with an Express.js app, listen on 0.0.0.0 (or app.listen(PORT) without binding to localhost only), run npx portpreview PORT, and register the HTTPS URL for webhooks, OAuth callbacks, and API demos.

Why tunnel Express

Express remains the default HTTP layer for Node APIs and BFFs. Payment providers, CRM webhooks, and OAuth servers need a public HTTPS endpoint while you debug middleware order and raw-body parsing locally.

Quick start

  1. Start Express: node server.js or npm run dev on port 3000.
  2. Run npx portpreview 3000.
  3. Test GET https://your-tunnel.portpreview.dev/health.
  4. Configure provider webhooks to POST https://your-tunnel.portpreview.dev/api/webhooks/....

Minimal Express server

import express from 'express';

const app = express();
const PORT = process.env.PORT ?? 3000;

app.get('/health', (_req, res) => res.json({ ok: true }));

app.listen(PORT, () => {
  console.log(`Listening on http://localhost:${PORT}`);
});

Express listens on all interfaces by default. If you bind explicitly, use '0.0.0.0' so the tunnel process can forward traffic.

Trust proxy headers

Behind PortPreview your app sees X-Forwarded-Proto: https. Enable trust proxy when generating absolute URLs or secure cookies:

app.set('trust proxy', 1);

CORS for split frontends

If a React or Vue dev server on another port calls your Express API through separate tunnels, configure CORS explicitly:

import cors from 'cors';
app.use(cors({ origin: process.env.FRONTEND_TUNNEL_URL }));

Security checklist

  • Verify webhook signatures before parsing JSON.
  • Never expose unauthenticated admin routes on a shared tunnel.
  • Stop the tunnel when finished. See tunnel security.

Express documentation covers middleware and routing. Start PortPreview free.

Frequently asked questions

How do I expose a Express.js dev server with PortPreview?
Start your Express.js app on localhost (usually port 3000), then run npx portpreview 3000 in another terminal. Use the HTTPS URL for webhooks, OAuth redirects, and sharing.
Can I test OAuth callbacks on localhost with Express.js?
External providers require a public HTTPS redirect URI. Register your PortPreview tunnel URL as the callback during development instead of http://localhost.
What is the most common Express.js tunneling mistake?
Mounting express.json() before webhook routes consumes the raw body. Apply express.raw() only on webhook paths before global JSON middleware.
Is it safe to share a Express.js tunnel URL?
Treat tunnel URLs like temporary credentials. Share only with trusted collaborators, disable when done, and never expose admin routes without authentication. See localhost tunnel security best practices.