Broch-Hosted Trial Quickstart

This is the Broch-hosted free trial — a place to verify Broch works for you before deploying it. For the real install, see Self-Hosting.

The Broch-hosted server at trial.broch.io lets prospective customers try Broch tunneling before committing to a self-hosted deployment. It is intentionally limited and is not a production offering.

The trial runs for 60 days — no credit card. When it ends, self-host to keep going: the same CLI, pointed at your own server URL.

Ready to evaluate the real product on your own infrastructure? Self-hosting has its own 15-day free trial — a card upfront, not charged — see Licensing.

The Broch-hosted trial is not a substitute for self-hosting

Most of the important benefits of Broch require self-hosting:

• Your own identity provider — SSO via Entra ID, Okta, Auth0, or any OIDC provider. The Broch-hosted trial uses shared Broch authentication.
• Ingress control — Share Policies restrict who can reach your tunnels by IP network (CIDR), HTTP header matching, or any combination. Only available on a self-hosted server.
• Audit logs — Full audit trail of who accessed what and when.
• Data sovereignty — Traffic tunnelled through your own infrastructure, never through Broch servers.
• Your own domain — Tunnel URLs under your wildcard domain (*.tunnels.company.com).

If you are evaluating Broch for your organization, plan to self-host. See the Self-Hosting guide.

Already self-hosting? If your organization runs its own Broch server, skip this page. Your admin will give you the server URL to use in place of trial.broch.io.

Step 1: Install the CLI

The CLI is distributed on npm and requires Node.js 22 or newer.

npm install -g @broch/cli

Verify the installation:

broch --version

Step 2: Configure the Server URL

broch config set --server https://trial.broch.io

Step 3: Authenticate

broch auth login

This opens your browser for sign-in. After you authorize, the CLI is ready to use.

Step 4: Create Your First Tunnel

broch share my-app --target http://localhost:3000

Replace 3000 with the port your local service is running on. Broch generates a public HTTPS URL you can share immediately.

While the tunnel is up, every inbound request is printed as a one-line summary so you can see traffic land in real time:

  my-app   ← GET → 200 / (5ms)
  my-app   ← POST → 201 /api/users (12ms)

Add --inspect to also serve a local inspector UI where you can expand each request and replay it against your local service — see Inspecting requests.

No local app? Try a public demo target

The trial server allows a small set of public sites as share targets, so you can watch a tunnel work end-to-end without running anything locally. Point --target at one of these instead of localhost:

broch share demo --target https://books.toscrape.com

Target	What it shows
https://example.com	The minimal smoke test. A single static page — proves the tunnel resolves and serves.
https://books.toscrape.com	A full bookstore catalog with relative links and images. Click around: every page, image, and request lands in your tunnel log. The best look at the proxy actually working.
https://httpbin.org	An HTTP echo service. Open /ip and you’ll see the Broch server’s address, not yours — proof the request egressed through the tunnel. Open /headers to see the forwarded request headers.

How well a site demos depends on how it’s built. Broch forwards requests; it doesn’t rewrite HTML. A site that links to its own pages and assets with relative URLs (books.toscrape.com) routes every sub-request back through the tunnel, so the whole page comes through. A site that uses absolute URLs for everything — e.g. https://www.washingtonpost.com/... in every link and asset — only routes the first request; your browser fetches the rest straight from the origin, and just the landing page renders through the tunnel. Either way, the tunnel log shows you exactly what reached the server.

These targets are pre-configured on the trial

You can point at these public sites because Broch has allow-listed them on the trial server. Non-loopback targets aren’t open by default — each one is registered as a Service and pinned by a Share Rule. On your own self-hosted server, an admin does this setup to decide which non-loopback targets your team may tunnel to. Loopback targets (localhost, 127.0.0.1) never need it.

Next Steps

• CLI Reference — All commands and options
• Self-Hosting — Deploy Broch for your team

Feedback

Bug reports, install trouble, and feature requests: email [email protected]. Anything else — feedback, partnerships, press: [email protected].