Real HTTPS domains for your local dev servers

lokal is an open-source command-line tool for macOS, with Linux as a preview. It gives each dev server you run its own domain with valid HTTPS: https://api.myapp.lokal instead of http://localhost:4000, with a certificate that your browser, curl, Node and Python trust. You set it up once. After that, adding a service takes milliseconds and never asks for a password.

$ lokal setup                        # once per Mac; asks for your password
$ lokal project create myapp         # claims myapp.lokal
$ lokal service add api 4000
✓ api.myapp.lokal → localhost:4000  (ready in 8ms)
  https://api.myapp.lokal
$ curl https://api.myapp.lokal       # works: no -k, no --cacert

When a command returns, the URL already works: the name resolves, the certificate exists and the route is live. There’s nothing to wait for and nothing to retry.

Before and after#

Why lokal#

• Real names. Every service gets its own hostname, so cookies, CORS, OAuth redirect URLs and subdomain routing behave the way they do in production. Services no longer share localhost cookies across ports.
• Valid HTTPS. Secure cookies, HTTP/2 and mixed-content rules work like they do in production, without -k, --insecure or clicking through browser warnings.
• Fast and quiet. Adding, changing or removing a service needs no sudo, no prompts and no restarts.
• Nothing leaves your computer. Every listener is on loopback, and names are never announced on your network.
• A narrowly scoped certificate authority. lokal’s CA can only sign .lokal names (and .local, lokal’s TLD before 0.6.0), never public domains or IP addresses. Even a leaked key can’t impersonate a real website.
• It handles your whole dev stack. WebSockets (Vite, Next.js and webpack hot reload), server-sent events, long polling, streaming uploads and HTTP/2 all pass through. localhost upstreams work whether your server listens on 127.0.0.1 or only on ::1.
• Scripts and coding agents can drive it. Every command is safe to re-run, every list command has a stable --json output, and exit codes say what went wrong.

Browsers and most macOS tools use the keychain, so they trust lokal as soon as setup finishes. On Linux, setup adds lokal’s CA to the system certificate store and to Chrome’s and Firefox’s own databases. Node, Python and some other tools ship their own certificate bundles. One line, eval "$(lokal env)", points them at lokal’s CA.

Requirements and status#

lokal is new and runs on macOS, with Linux as a preview:

• macOS 14 Sonoma or later. lokal is developed and tested on macOS 27. Older versions should work but haven’t been tested yet.
• Apple Silicon. Intel builds are published, but they haven’t been tested on an Intel Mac yet.
• Linux is a preview, on x86_64 and arm64, with .deb and .rpm packages since 0.5.1. Setup needs systemd 258 or later, such as Ubuntu 26.04 or Fedora 43. See Linux (preview).
• Windows isn’t supported yet. The code is structured so it can be added later, and PORTING.md collects what each OS needs.

If you run lokal on an Intel Mac or an older macOS version, reports are welcome in the issue tracker.

lokal is free and open source, licensed under Apache-2.0. The code is on GitHub.

Where to next#

• Install lokal with Homebrew, a prebuilt binary, a .deb or .rpm, or from source.
• Set it up once: what lokal setup changes, and the only commands it runs with sudo.
• Quick start: create a project, add services and open them, in five minutes.
• Projects and services: apex domains, nested names, other hosts.
• A whole repo with lokal up: one lokal.toml, and one command starts every dev server.
• Frameworks: Vite and other dev servers that check the Host header.
• Coding agents: let an agent set up routes for your repo.
• How it works and the security model.
• Choosing between tools? See how lokal compares, for example with LocalCan.
• Command reference: every command and flag.
• Something broken? Start with troubleshooting and the FAQ.