Anywhere you'd reach for a tunnel to put something local on the public internet — the same jobs ngrok's gateway does, but on a server you own.

Local dev previews & demos

Put a work-in-progress app on a real, browser-trusted HTTPS URL — your own domain — to share with a teammate or client without deploying.

seikan serve app.example.com 3000

Webhook development

Receive Stripe, GitHub, Slack, or any provider's webhooks directly against code running on your laptop, over HTTPS, instead of redeploying to test each change.

Services behind NAT or a firewall

Expose a home-lab or office service with no inbound ports and no port-forwarding — the client dials out, so it works behind NAT (even double-NAT) and restrictive firewalls.

Remote access to TCP services

Reach SSH, Postgres, Redis, RDP, MQTT, or a game server on a stable public TCP port — a reverse-tunnel alternative for remote machines and devices, and a simple way to link two networks without a VPN.

seikan serve --tcp 22 --name ssh
#  -> ssh user@<server> -p <assigned-port>

Private box-to-box connections (no public exposure)

Reach a database or internal service on one machine from another, without ever putting it on the public internet — not a public port, not even briefly. A peer tunnel (see the Client reference) relays the connection through the server between two clients, gated by two independent one-time secrets (one to register the backend, one to relay a connection in).

seikan serve --peer --name pgdb 5432                          # box with Postgres
seikan forward --server <host:443> --token sk_t_... --listen 5432   # box that wants to reach it

Mobile & external integration testing

Point a phone, a partner's system, or a third-party cloud service at the backend running on your machine — useful while building against an API you don't control.

AI agent & tool callbacks

Let a cloud AI platform call back into a local tool, MCP server, or function endpoint during development, without standing up infrastructure first.

Zero-downtime & scale-out

Run several clients on the same frontend: HTTP traffic is load-balanced with sticky sk_aff session affinity (great for rolling restarts across machines), and TCP frontends run active/standby with automatic failover. See the Security & FAQ for details.

Self-hosted, own your data. Unlike a hosted gateway, you run the server, hold the Let's Encrypt certificates, and control the domains and ports — no third party sits in the path of your traffic, and there are no per-tunnel limits or seat pricing.