Documentation

Local development with hosted Duct

Hosted agent-proxy cannot call localhost or private IPs (SSRF protection). Use a tunnel when your manifest apiBaseUrl would otherwise point at your machine.

Run npx @duct-sdk/sdk checkup — it fails early when your profile is hosted but product.apiBaseUrl is still local.

Workflow

1. Start your app API locally (for example localhost:8080). 2. Start a generic HTTP tunnel that forwards a public HTTPS URL to that port (any tunnel product your team already uses). 3. Set product.apiBaseUrl in duct.config.ts to the tunnel URL and duct push. 4. Use hosted Duct normally from the dashboard and shell. 5. Before production, switch apiBaseUrl back to your public API origin.

Runtime errors

If invoke returns private_upstream_rejected, the platform blocked a private target — fix the manifest URL or use a tunnel as above.