Fast answer
Compare Oxaa with Tailscale Funnel by the workflow a developer must complete, not by a copied feature grid. The production page requires current official sources, equal-condition tests, dated plan and region assumptions, migration and rollback.
Fit decision
Oxaa: Choose Oxaa for an independent public development endpoint and local inspection.
Tailscale Funnel: Choose the competitor when public sharing is a natural extension of an existing private-network deployment.
Reproducible comparison method
- Display research date, tested product versions, plans, regions and official sources.
- Describe each product neutrally before stating fit.
- Run the same local fixture, source network and request set.
- Record install, edge readiness, first request, data location, Host/headers, WebSocket/SSE, limits, failure recovery and cleanup.
- Do not turn one test into a universal latency, reliability, security or privacy claim.
- Show current pricing dimensions with source date; do not force non-equivalent plans into a false score.
- Provide migration commands, provider/domain changes, rollback, correction contact and change log.
How traffic and Inspector data are handled
Oxaa's public edge terminates public HTTPS so it can resolve the exact hostname, identify the current authenticated route and forward the request. The session between the enrolled device and Oxaa is encrypted; the selected local service receives the request through that session.
Oxaa retains bounded account, route, usage, security, billing, support and diagnostic metadata required to operate and protect the service. Inspector body capture is a separate, explicit debugging action: the bounded request or response body copy shown by the local Inspector remains on the developer device and can be redacted, deleted or allowed to expire. Public traffic still has to be processed by the edge, so the accurate claim is local Inspector copies-not “Oxaa cannot see traffic.”
Route identity and the selected-service boundary
The enrolled device initiates the connection. Locally generated device identity, proof of possession, short-lived route generations and exact-host matching bind the hostname to the current route. Unknown, malformed, revoked or stale ownership fails closed instead of being forwarded to an uncertain destination.
Oxaa publishes only the configured local target. Private-network destinations require explicit authorization, while public, metadata, link-local, multicast and other unsafe destination classes remain blocked by policy.
Cleanup and production handoff
Remove the external callback, preview URL or DNS binding; rotate test credentials; delete local captures; stop the route; and revoke the device or session when appropriate. Move production traffic to the deployed application, production ingress or event-delivery platform designed for that job.
What Oxaa is - and is not
Oxaa is development connectivity for a selected local HTTP or HTTPS service while the enrolled device and authenticated route are live. It is not application hosting, a general VPN, a forward proxy, permanent production deployment, raw TCP/UDP tunneling, arbitrary TLS passthrough, a CDN/WAF replacement or a production webhook delivery platform.