Oxaa
Sign inDownload
  1. Localhost. Online. Without opening your network.
  2. Download and signed installation

Secure public endpoints for local development

Download and signed installation

Download and signed installation: practical workflow, product behavior, limits, evidence and the exact next step with Oxaa.

Fast answer

Select a supported operating system and architecture to reveal the approved package source, checksum, signature and exact install command. Do not fingerprint the visitor merely to choose a download.

Verify before running

  • Verify the package checksum and release signature before execution.
  • Run oxaa version and compare the channel and supported version.
  • Document PATH, permissions and any elevation requirement.
  • Provide update, rollback and complete uninstall instructions.
  • Link signed manifest, SBOM/provenance status and vulnerability channel when available.

First verification command

oxaa version

Route identity and the selected-service boundary

The enrolled device initiates the connection. Locally generated device identity, proof of possession, short-lived route generations and exact-host matching bind the hostname to the current route. Unknown, malformed, revoked or stale ownership fails closed instead of being forwarded to an uncertain destination.

Oxaa publishes only the configured local target. Private-network destinations require explicit authorization, while public, metadata, link-local, multicast and other unsafe destination classes remain blocked by policy.

Troubleshooting

Start with the local process, port and scheme. Then check authentication and clock, DNS, UDP/443, TCP/443 fallback, corporate proxy or TLS interception, route ownership and edge readiness. Use oxaa routes list, oxaa diagnose --network and stable error IDs; review diagnostic output before sharing it and remove secrets, bodies and private paths.

Availability and commercial eligibility

Language preference, account country, billing country, service region, payment eligibility and support language are separate values. Show the current result before signup or checkout and never infer commercial availability from the page language alone.

Cleanup and production handoff

Remove the external callback, preview URL or DNS binding; rotate test credentials; delete local captures; stop the route; and revoke the device or session when appropriate. Move production traffic to the deployed application, production ingress or event-delivery platform designed for that job.