> ## Documentation Index
> Fetch the complete documentation index at: https://docs.notte.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# Tunnel

> Route sessions through this machine's internet connection

<Tip>
  Read [the Notte skill](https://notte.cc/skill.md) and follow its setup instructions when setting up Notte or building browser automation. This is the shared source for CLI setup, authentication, and the browser-to-code workflow.
</Tip>

Route session traffic through this machine's internet connection using Tailscale. "notte tunnel up" offers this machine as a Tailscale exit node and saves it as a named tunnel; "notte tunnel check" verifies it end to end; and "notte sessions start `--tunnel` \<name>" then sends the session's public traffic out through it.

Requires Tailscale running and signed in on this machine, and a Tailscale OAuth client (auth\_keys write scope, tagged tag:notte only). Connect the client once in the Notte console (Settings > Integrations), or pass it to "tunnel up" to keep it on this machine. Your tailnet policy must let tag:notte reach autogroup:internet, and this machine must be approved as an exit node.

## `notte tunnel check`

Verify that sessions leave through a saved tunnel.

The check starts a short session through the tunnel, opens an IP lookup inside it, and compares the session's public IP with this machine's. The session is billed like any other (usually well under a minute) and is closed when the check ends.

If the Notte workspace has no Tailscale connection, connect one in the console (Settings > Integrations) first.

| Flag | Description |
| - | - |
| `--name <string>` | Tunnel to check (default: this machine's MagicDNS host name) |

```bash theme={null}
notte tunnel check
notte tunnel check --name home-mac
```

## `notte tunnel down`

Stop offering this machine as a Tailscale exit node. Saved tunnels are kept, so "notte tunnel up" can bring it back without credentials.

## `notte tunnel list`

List saved tunnels

## `notte tunnel remove <name>`

Delete a saved tunnel and its stored credentials

## `notte tunnel up`

Offer this machine as a Tailscale exit node and save it as a named tunnel.

Without credentials, the tunnel uses the Tailscale OAuth client connected to your Notte workspace in the console (Settings > Integrations), and nothing secret is stored on this machine.

To keep the client on this machine instead, pass `--oauth-client-id` and `--oauth-client-secret` (or NOTTE\_TAILNET\_OAUTH\_CLIENT\_SECRET). The secret is stored in the keyring, never in the config file. Re-running "up" for a saved tunnel reuses its stored credentials.

| Flag | Description |
| - | - |
| `--name <string>` | Tunnel name (default: this machine's MagicDNS host name) |
| `--oauth-client-id <string>` | Tailscale OAuth client ID (default: the workspace's console connection) |
| `--oauth-client-secret <string>` | Tailscale OAuth client secret (or set NOTTE\_TAILNET\_OAUTH\_CLIENT\_SECRET) |

```bash theme={null}
notte tunnel up --name home-mac
notte tunnel up --name home-mac --oauth-client-id <id> --oauth-client-secret <secret>
notte sessions start --tunnel home-mac
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.