# Serverless and Edge Runtimes

> Use the HTTPS forward gateway from a function runtime that offers fetch and no raw sockets, so outbound requests still leave from the agent's own address.

*Source: https://www.whisper.security/docs/network/egress/serverless*

---
A tunnel and a SOCKS proxy both need a socket. Some function runtimes give you `fetch` and
nothing lower, so this job uses one HTTPS hop instead: you post the request to the
gateway, the gateway dials the target from your agent's address, and you get the origin
response back.

## 1. Get the bearer

```bash
whisper connect --agent checkout-bot --json
```

The bearer is the password element of the `connection_string` and `http_proxy` values the
call returns, in the form `et_...`. The same value is what the gateway accepts. Details are
on [Egress Authentication](/docs/network/egress/auth).

## 2. Put it in the function's environment

Store it as a secret in your platform, not in the deployed source, and read it at runtime.
The examples below expect it in `WHISPER_EGRESS_BEARER`.

## 3. Send the request through the gateway

The target URL and the method travel as headers. The credential is Basic, with the literal
username `w`.

```bash
curl -s -X POST https://forward.whisper.online/forward \
  -u "w:$WHISPER_EGRESS_BEARER" \
  -H 'X-Whisper-Target: https://api.example.com/v1/orders' \
  -H 'X-Whisper-Method: GET'
```

The same call from a function:

```js
const res = await fetch("https://forward.whisper.online/forward", {
  method: "POST",
  headers: {
    authorization: "Basic " + btoa("w:" + env.WHISPER_EGRESS_BEARER),
    "x-whisper-target": "https://api.example.com/v1/orders",
    "x-whisper-method": "GET",
  },
});
```

A request body you pass is forwarded to the target, and the origin's response comes back
verbatim, so your code reads the status, headers and body it would have read on a direct
call.

## 4. Confirm the source

The response carries `X-Whisper-Egress-Source`, which names the address the gateway dialled
from. To see it end to end, point the gateway at the keyless echo and read both:

```bash
curl -s -i -X POST https://forward.whisper.online/forward \
  -u "w:$WHISPER_EGRESS_BEARER" \
  -H 'X-Whisper-Target: https://rdap.whisper.online/egress-ip' \
  -H 'X-Whisper-Method: GET'

x-whisper-egress-source: 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478
{"ip":"2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478"}
```

Both values are the agent's address, and the body is what the target itself reported, which
makes it the check to keep in a smoke test.

## 5. Handle a refusal

A target the gateway's request guard declines comes back as a problem document rather than
a relayed response, so branch on the content type before you parse a payload. A missing or
rejected credential is answered as a proxy authentication failure; re-read the bearer from
your secret store rather than retrying the same value in a loop.

## Where to go next

If the runtime can hold a socket after all, the bound proxy is fewer moving parts: see
[Send Traffic From Your Address](/docs/network/egress/connect) and [Connectivity
Tiers](/docs/network/egress/tiers). If the target you need answers only on the older
protocol, read [Reaching IPv4 Destinations](/docs/network/egress/ipv4).