Real HTTPS domains for your local dev servers

lokal is an open-source command-line tool for macOS. It gives each dev server you run its own domain with valid HTTPS: https://api.myapp.lokal instead of http://localhost:4000, with a certificate that your browser, curl, Node and Python trust. You set it up once. After that, adding a service takes milliseconds and never asks for a password.

$ lokal setup                        # once per Mac; asks for your password
$ lokal project create myapp         # claims myapp.lokal
$ lokal service add api 4000
✓ api.myapp.lokal → localhost:4000  (ready in 8ms)
  https://api.myapp.lokal
$ curl https://api.myapp.lokal       # works: no -k, no --cacert

When a command returns, the URL already works: the name resolves, the certificate exists and the route is live. There’s nothing to wait for and nothing to retry.

Before and after#

Why lokal#

• Real names. Every service gets its own hostname, so cookies, CORS, OAuth redirect URLs and subdomain routing behave the way they do in production. Services no longer share localhost cookies across ports.
• Valid HTTPS. Secure cookies, HTTP/2 and mixed-content rules work like they do in production, without -k, --insecure or clicking through browser warnings.
• Fast and quiet. Adding, changing or removing a service needs no sudo, no prompts and no restarts.
• Nothing leaves your Mac. Every listener is on loopback, and names are never announced on your network.
• A narrowly scoped certificate authority. lokal’s CA can only sign .lokal and .local names, never public domains or IP addresses. Even a leaked key can’t impersonate a real website.
• It handles your whole dev stack. WebSockets (Vite, Next.js and webpack hot reload), server-sent events, long polling, streaming uploads and HTTP/2 all pass through. localhost upstreams work whether your server listens on 127.0.0.1 or only on ::1.
• Scripts and coding agents can drive it. Every command is safe to re-run, every list command has a stable --json output, and exit codes say what went wrong.

Browsers and most macOS tools use the keychain, so they trust lokal as soon as setup finishes. Node, Python and some other tools ship their own certificate bundles. One line, eval "$(lokal env)", points them at lokal’s CA.

Requirements and status#

lokal is new (v0.1) and runs on macOS only:

• macOS 14 Sonoma or later. lokal is developed and tested on macOS 27. Older versions should work but haven’t been tested yet.
• Apple Silicon. Intel builds are published, but they haven’t been tested on an Intel Mac yet.
• Linux and Windows aren’t supported yet. The code is structured so they can be added later. Linux support is on the roadmap, and PORTING.md collects what each OS needs.

If you run lokal on an Intel Mac or an older macOS version, reports are welcome in the issue tracker.

lokal is free and open source, licensed under Apache-2.0. The code is on GitHub.

Where to next#

• Install lokal with Homebrew, a prebuilt binary or from source.
• Set it up once: what lokal setup changes, and the only commands it runs with sudo.
• Quick start: create a project, add services and open them, in five minutes.
• Projects and services: apex domains, nested names, other hosts.
• Frameworks: Vite and other dev servers that check the Host header.
• Coding agents: let an agent set up routes for your repo.
• How it works and the security model.
• Command reference: every command and flag.
• Something broken? Start with troubleshooting and the FAQ.