← Integrations

HTTP Proxy Integration

The HTTP Proxy integration serves as an HTTP(S) proxy that injects a header into your request. This can be useful to interact with an API that requires a bearer token.

For example, the following snippet creates, attaches, and uses the http proxy integration to inject a header into a request.

exe.dev ▶ integrations add http-proxy --name mirror --target https://httpbin.org/ --header prettiest-of-them-all:me --attach vm:my-vm-name
Added integration mirror

Usage from a VM:
  ssh my-vm-name.exe.xyz curl http://mirror.int.exe.xyz/

exe.dev ▶ ssh my-vm-name.exe.xyz curl -s http://mirror.int.exe.xyz/anything -Hfoo:bar
{
  "args": {},
  "data": "",
  "files": {},
  "form": {},
  "headers": {
    "Accept": "*/*",
    "Accept-Encoding": "gzip",
    "Foo": "bar",
    "Host": "httpbin.org",
    "Prettiest-Of-Them-All": "me",
    "User-Agent": "curl/8.5.0",
    "X-Amzn-Trace-Id": "Root=1-69b339a2-0032d20f5263c6dc17235289"
  },
  "json": null,
  "method": "GET",
  "origin": "64.34.88.25",
  "url": "https://httpbin.org/anything"
}

The HTTP Proxy integration supports HTTP basic auth as well. When the injected header carries a real credential (e.g. --bearer), remember it is stored server-side and never visible from the VM — see Where secrets live.

Path rewriting with --strip-prefix

Some APIs mount every endpoint under a version prefix (say /api/v3) that you want to drop when proxying: requests to the integration should reach the target with the prefix removed. --strip-prefix does exactly that — a static path prefix stripped from the front of each matching request before forwarding:

exe.dev ▶ integrations add http-proxy --name myapi --target https://api.example.com --bearer sk-... --strip-prefix /api/v3

With that configuration, from an attached VM:

  • http://myapi.int.exe.xyz/api/v3/users → https://api.example.com/users
  • http://myapi.int.exe.xyz/api/v3 → https://api.example.com/
  • http://myapi.int.exe.xyz/healthz → https://api.example.com/healthz (a path outside the prefix passes through unchanged)

Matching is segment-aligned: /api/v3x/other does not match /api/v3 and is forwarded verbatim. The prefix must start with /, contains no regex — only letters, digits, and - _ . ~ in path segments — and composes with --header/--bearer/basic-auth injection unchanged. Use integrations edit <name> --strip-prefix <new> to change it, or --strip-prefix="" to remove it. (The target URL itself still must not carry a path; --strip-prefix is the sanctioned way to express a path rewrite, in the request direction only.)

Peer Integrations (VM-to-VM)

The --peer flag turns an HTTP proxy integration into a VM-to-VM proxy: the --target is another VM you own, and exe.dev injects a generated API key so the source VM can reach the target without managing tokens itself. Requests arrive at the target with an X-Exedev-Source-Vm header naming the caller. The platform signs an attestation alongside it and delivers the header only when that attestation verifies, so it cannot be forged.

exe.dev ▶ integrations add http-proxy --name talk-to-bob --target https://bob.<your-domain>/ --peer --attach vm:alice

From alice, requests to http://talk-to-bob.int.exe.xyz/ arrive at bob with X-Exedev-Source-Vm: alice.

See the VM-to-VM Integration page for the full story: the auth model, using the source-VM header safely, UI setup, and a two-agent example.