Serverless and Edge Runtimes

A tunnel and a SOCKS proxy both need a socket. Some function runtimes give you fetch and nothing lower, so this job uses one HTTPS hop instead: you post the request to the gateway, the gateway dials the target from your agent's address, and you get the origin response back.

1. Get the bearer

whisper connect --agent checkout-bot --json

The bearer is the password element of the connection_string and http_proxy values the call returns, in the form et_.... The same value is what the gateway accepts. Details are on Egress Authentication.

2. Put it in the function's environment

Store it as a secret in your platform, not in the deployed source, and read it at runtime. The examples below expect it in WHISPER_EGRESS_BEARER.

3. Send the request through the gateway

The target URL and the method travel as headers. The credential is Basic, with the literal username w.

curl -s -X POST https://forward.whisper.online/forward \
  -u "w:$WHISPER_EGRESS_BEARER" \
  -H 'X-Whisper-Target: https://api.example.com/v1/orders' \
  -H 'X-Whisper-Method: GET'

The same call from a function:

const res = await fetch("https://forward.whisper.online/forward", {
  method: "POST",
  headers: {
    authorization: "Basic " + btoa("w:" + env.WHISPER_EGRESS_BEARER),
    "x-whisper-target": "https://api.example.com/v1/orders",
    "x-whisper-method": "GET",
  },
});

A request body you pass is forwarded to the target, and the origin's response comes back verbatim, so your code reads the status, headers and body it would have read on a direct call.

4. Confirm the source

The response carries X-Whisper-Egress-Source, which names the address the gateway dialled from. To see it end to end, point the gateway at the keyless echo and read both:

curl -s -i -X POST https://forward.whisper.online/forward \
  -u "w:$WHISPER_EGRESS_BEARER" \
  -H 'X-Whisper-Target: https://rdap.whisper.online/egress-ip' \
  -H 'X-Whisper-Method: GET'

x-whisper-egress-source: 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478
{"ip":"2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478"}

Both values are the agent's address, and the body is what the target itself reported, which makes it the check to keep in a smoke test.

5. Handle a refusal

A target the gateway's request guard declines comes back as a problem document rather than a relayed response, so branch on the content type before you parse a payload. A missing or rejected credential is answered as a proxy authentication failure; re-read the bearer from your secret store rather than retrying the same value in a loop.

Where to go next

If the runtime can hold a socket after all, the bound proxy is fewer moving parts: see Send Traffic From Your Address and Connectivity Tiers. If the target you need answers only on the older protocol, read Reaching IPv4 Destinations.