The webhook treadmill is a cross-border tax nobody budgets for
Every cross-border seller I know runs some unholy mix of storefronts, marketplaces, ad platforms, and payment rails that all need to talk to each other. And every one of those integrations eventually needs a callback URL — a webhook endpoint, an OAuth redirect, a Stripe event listener — that has to stay put. The moment you’re developing locally behind a tunnel that hands you a random hostname on every restart, you’re re-pasting that URL into Amazon Seller Central, Shopify admin, Klaviyo, or your payment provider’s dashboard over and over. It’s a small friction that compounds into real hours, and it’s exactly the kind of infrastructure tax that eats operator attention. So when a tool shows up promising a stable URL for free over plain SSH, I pay attention — not because it’s glamorous, but because webhook plumbing is the unglamorous layer that breaks at 2 a.m. during a flash sale.
What tunnl.gg actually solves
The maker, Konstantinos Lypitkas, frames the problem bluntly: he got tired of re-registering webhooks. Every time a tunnel restarted, he got a new random URL, which meant updating Stripe, GitHub, or an OAuth callback again and again. His fix is a tunnel that hands you the same URL every time, for free, invoked with a single command:
ssh -t -R 80:localhost:3000 [email protected]
The clever bit is identity. Your SSH key is your identity, so the URL follows your key across restarts, reboots, and Wi-Fi changes. Register it once and forget it. That’s the whole pitch, and it’s a good one because it removes a step rather than adding a dashboard.
The supporting details matter for operators who’ve been burned by dev tools that assume a Mac and a fast connection:
- Nothing to install and no sign-up — it’s plain SSH, already present on macOS, Linux, and Windows.
- Automatic HTTPS and WebSockets.
- A QR code and a live request log right in the terminal, which is genuinely useful for testing a checkout flow on your phone.
- The server is open source under MIT, so you can read exactly what it does or self-host.
There’s a Pro tier at $5/month billed yearly. It adds names you choose like myapp.tunnl.gg, no time limits, no warning page for visitors, passwords and IP allowlists, and a request inspector with replay.
Why this is a bigger deal for marketplace operators than for indie hackers
The Product Hunt crowd will read this as a developer convenience. I read it as an operational reliability question. If you’re an Amazon FBA brand owner running a custom middleware layer between Seller Central notifications and your internal systems, or a TikTok Shop operator wiring order events into a fulfillment queue, the stability of your callback endpoints is a production concern, not a dev-environment nicety. A rotating URL isn’t just annoying — it’s a silent failure mode. The platform keeps firing events at a dead hostname, you keep wondering why your inventory sync is stale, and nobody gets an alert because from the marketplace’s perspective everything returned a 404 and moved on. Stable endpoints shrink that blast radius.
How it stacks up against the incumbents
The tunnel space is not empty, and any operator evaluating tunnl.gg should know the alternatives.
ngrok is the default answer for most developers. It’s polished, has a mature dashboard, and its paid tiers offer reserved domains. But the free tier historically hands you ephemeral URLs, which is precisely the pain tunnl.gg is targeting, and the pricing climbs quickly once you need stability and team features. If you already live in ngrok’s ecosystem, the switching cost is real.
Cloudflare Tunnel is the heavyweight. If you’re already on Cloudflare for DNS and CDN — and a lot of DTC brands are — you get stable hostnames, strong security posture, and no per-tunnel fee. The tradeoff is setup complexity: you’re configuring a daemon, managing certificates, and thinking in Cloudflare’s vocabulary. For a solo operator who just wants ssh and a URL, that’s overkill.
localtunnel and similar open-source options are free but generally give you random subdomains, which puts you right back on the treadmill.
Where tunnl.gg differentiates is the intersection of three things: stability, zero-install SSH, and open source. ngrok gives you stability but not zero-install. Cloudflare gives you stability and openness but not zero-install. localtunnel gives you zero-install but not stability. tunnl.gg’s bet is that the SSH-key-as-identity trick is enough to win the “I just want it to work” segment.
The self-hosting angle is the sleeper feature
For cross-border sellers, data residency and vendor dependency are not abstract concerns. If you’re running payment webhooks or handling customer PII, routing that traffic through a third-party tunnel you don’t control is a compliance question your legal counsel may eventually ask about. The fact that the server is MIT-licensed and self-hostable means a technically capable operator — or their dev shop — can run the same stable-URL mechanism on their own infrastructure. That’s a meaningful escape hatch, and it’s the kind of thing ngrok’s hosted model doesn’t offer at the free tier.
What cross-border sellers can borrow from this
Even if you never touch tunnl.gg, the design philosophy is worth stealing.
Treat identity as the anchor, not the address. The reason webhook re-registration is painful is that we tie integrations to hostnames instead of to identities. tunnl.gg flips that: your SSH key is the identity, and the URL is derived from it. The broader lesson for operators is to build your integration layer so that the logical endpoint is stable even if the physical one moves. Use a stable DNS name you control, point it at whatever tunnel or load balancer is live today, and update one record instead of fifteen dashboards. This is the same reason serious sellers put a reverse proxy in front of their middleware rather than exposing raw service URLs.
Minimize the number of places a URL lives. Every platform where you’ve pasted a callback URL is a place that breaks when the URL changes. Audit yours this week. I’d bet you find stale endpoints in a Shopify app config, a Stripe webhook list, a Klaviyo flow, and at least one marketplace integration that nobody remembers setting up.
Prefer tools that fail loudly. The request inspector with replay in tunnl.gg’s Pro tier is the feature I’d actually pay for, because it turns a silent 404 into a visible event. In cross-border ops, where you’re often debugging across time zones and languages, observability on your own plumbing is worth more than another growth tool.
Where the math breaks
Let’s be honest about the Pro tier. $5/month billed yearly is cheap — but it’s billed yearly, which means you’re committing $60 up front for a tool that competes with free tiers and a $0 Cloudflare option if you already have the account. The value proposition only holds if you actually need named subdomains, no warning page for visitors, passwords, IP allowlists, and request replay. A seller running a single dev environment probably doesn’t. A team running multiple staging environments, or exposing a tunnel to a client for review, probably does.
The “no warning page for visitors” detail is worth flagging. Free tunnels that inject an interstitial warning page are a non-starter for anything customer-facing — you can’t send a prospect a demo link that opens with a security scare. If tunnl.gg’s free tier includes that warning page, then the free tier is effectively dev-only, and the real product starts at $5/month. That’s fine, but it should be priced and positioned as such.
Where my judgment says it falls short
A few things give me pause.
The SSH-key-as-identity model has a sharp edge. If you lose the key, you lose the URL — and if that URL is baked into a dozen platform dashboards, you’re re-registering everything anyway. There’s no mention in the launch of key rotation, recovery, or team sharing. For a solo developer that’s fine. For a brand with a dev who might leave, it’s a continuity risk. I’d want to know how multiple team members share a stable endpoint before I’d standardize on this.
No sign-up is a feature and a liability. Zero-friction onboarding is great until you need support, billing history, or an audit trail of who registered which endpoint. The absence of an account layer makes team governance harder.
The competitive moat is thin. The core mechanism — stable URL from SSH key — is not hard to replicate, and the incumbents have distribution. tunnl.gg’s best defense is the open-source, self-hostable angle and the zero-install simplicity. If ngrok or Cloudflare decide to match the zero-install experience, the differentiation evaporates.
The launch gives no uptime or scale commitments. For a production webhook endpoint, “the server is open source” is not an SLA. I’d want to see status pages, incident history, and rate limits before I’d route revenue-critical events through it. Not disclosed in the launch, and that’s a gap for any operator considering it beyond local development.
Why Amazon sellers should care more than Shopify ones
Shopify’s webhook story is comparatively forgiving — you can update webhook endpoints through the admin or API with relative ease, and the platform is built for a developer-friendly ecosystem. Amazon Seller Central and its notification systems are less flexible, and the cost of a broken integration is higher because order and inventory events are the lifeblood of the operation. If you’re building custom tooling on top of Amazon’s APIs, endpoint stability isn’t a convenience — it’s risk management. Same logic applies to TikTok Shop and Temu seller integrations, where the platform tooling is younger and less forgiving.
What I’d watch / test next
This week, before you adopt anything, do three things. First, audit every callback and webhook URL across your stack — Shopify, Stripe, Klaviyo, your marketplace integrations — and flag the ones pointing at ephemeral hosts. Second, if you’re doing local development against those integrations, spin up tunnl.gg with the single SSH command above and see whether the stable-URL promise holds across a laptop sleep and a network switch; that’s the real test, not the happy-path demo. Third, if it works, pressure-test the Pro tier’s request inspector with replay on a non-critical webhook before you trust it with payment events.
My broader watch item is whether the maker adds team sharing and key recovery. Those two features would move this from “great solo dev tool” to “defensible infrastructure for a small cross-border team.” Until then, I’d treat tunnl.gg as a sharp utility for development and staging, and keep revenue-critical production webhooks on infrastructure with an actual uptime commitment. The idea is right; the operational maturity is still a question mark.
