Zuplo CLI: Dev

Local mTLS client certificates

On managed-dedicated and self-hosted projects, zuplo dev presents client certificates to your backend, so routes that set mtlsCertificate work locally without a code change.

Put each certificate in its own subdirectory of .zuplo-local/mtls, named after the certificate:

Code
.zuplo-local/mtls/my_backend_cert/tls.crt
.zuplo-local/mtls/my_backend_cert/tls.key

zuplo dev finds that directory automatically and logs the certificates it loaded. To read certificates from somewhere else, pass --mtls-certs:

Code
npx zuplo dev --mtls-certs ~/certs/zuplo-uat

The flag takes precedence over .zuplo-local/mtls and fails fast when the directory is missing or holds no valid certificate.

.zuplo-local/ contains unencrypted private keys. Projects created with create-zuplo-api gitignore it already; for older projects, add .zuplo-local/ to your .gitignore. zuplo dev warns at startup when it isn't covered.

The project type comes from projectType in zuplo.jsonc. If that field is missing, run zuplo link to have the CLI detect and write it — otherwise local development falls back to managed-edge and skips mTLS.

On managed-edge projects, local mTLS isn't available and --mtls-certs is ignored with a warning. For the full workflow, including certificate requirements and troubleshooting, see Gateway to Origin mTLS Authentication.

Examples

Options