Piko

Paid APISelf-hosted

What Piko is

Piko is an open-source, self-hosted reverse proxy for tunneling traffic to services without publicly routable paths. Upstream services open outbound-only connections to Piko, which forwards incoming requests through those tunnels. It supports HTTP, HTTPS, and TCP traffic, using the Host header or x-piko-endpoint header to select HTTP endpoints. Multiple upstreams on one endpoint receive load-balanced requests. Piko can run as a node cluster for fault tolerance, horizontal scaling, and zero-downtime deployments. Client JWTs can be verified with HMAC, RSA, or ECDSA keys, with optional endpoint restrictions based on claims. A Prometheus endpoint, access logs, and a status API support monitoring and debugging. Deployment options include a binary, Docker image, or source build, and a Go SDK can create listeners. Documentation covers Kubernetes Gateway and HTTP load-balancer hosting. Uses include exposing customer-network services, bring-your-own-cloud services, and user devices. The project is distributed under the MIT License.

Who it suits

Piko suits teams that need to connect privately hosted services or devices without exposing them directly. It is intended for self-hosted deployments, including clustered production setups and Kubernetes environments.

What it does well

Outbound tunnels avoid public upstream routes
Supports HTTP, HTTPS, and TCP
Cluster operation for fault tolerance and scaling
JWT verification with several key types
Prometheus endpoint, logs, and status API

What to know first

Self-hosted deployment required
Raw TCP cannot identify target endpoints directly
Operations require managing tunnels and infrastructure
MIT-licensed project provides no hosted service

Verdict

Piko offers tunneling, routing, authentication, and deployment flexibility for services that are not publicly routable. Its self-hosted model and raw-TCP routing limitation matter when planning architecture.

Facts from Piko's own pages

Authentication: Piko can verify client JWTs using HMAC, RSA, or ECDSA keys, with optional endpoint access restrictions in JWT claims. · github.com, 4 Oct 2026
Deployment: Piko can be downloaded as a binary, built from source, or run as a Docker image. · github.com, 4 Oct 2026
Getting started: The maker's getting-started guide demonstrates a three-node Piko cluster behind an NGINX load balancer using Docker Compose. · github.com, 11 Oct 2026
HTTP routing: HTTP(S) requests select an endpoint using either the Host header or the x-piko-endpoint header. · github.com, 11 Oct 2026
Integrations: Piko provides a Go SDK and documents hosting behind a Kubernetes Gateway or HTTP load balancer. · github.com, 4 Oct 2026
Intended use: The project describes use cases including exposing services in a customer network, bring-your-own-cloud services, and connecting to user devices. · github.com, 4 Oct 2026
Kubernetes hosting: Piko is designed to run behind an HTTP load balancer or Kubernetes Gateway, including as a StatefulSet. · github.com, 11 Oct 2026
License: The project is released under the MIT License. · github.com, 11 Oct 2026
Load balancing: Requests are load balanced among available upstreams listening on the same endpoint. · github.com, 11 Oct 2026
Notable TCP limit: Raw TCP requests cannot identify a target endpoint at the Piko server, so they must connect through Piko forward or the Go SDK. · github.com, 11 Oct 2026
Observability: Piko provides a Prometheus endpoint, access logging, and a status API for monitoring and debugging. · github.com, 11 Oct 2026
Outbound tunnels: Upstream services open outbound-only connections to Piko, which forwards incoming traffic through those connections. · github.com, 11 Oct 2026
Production scaling: Piko is designed to run as a cluster for fault tolerance, horizontal scaling, and zero-downtime deployments. · github.com, 11 Oct 2026
Production use: The server can run as a cluster of nodes for fault tolerance, horizontal scaling, and zero-downtime deployments. · github.com, 4 Oct 2026
Protocols: Piko supports HTTP, HTTPS, and TCP traffic. · github.com, 4 Oct 2026
Purpose: Piko is an open-source reverse proxy for tunneling traffic to services that are not publicly routable. · github.com, 11 Oct 2026
Routing: Requests can target endpoints using the Host header or x-piko-endpoint header, and requests to endpoints with multiple upstreams are load balanced. · github.com, 4 Oct 2026
Security: The maker describes Piko as providing a secure way to connect to services that are not publicly routable, and documents TLS support for Piko forward. · github.com, 11 Oct 2026
Support: The project directs users to GitHub Discussions for questions, help, and ideas. · github.com, 11 Oct 2026
TCP routing: TCP traffic can be forwarded with Piko forward or the Go SDK, and Piko forward can authenticate to the server and use TLS. · github.com, 11 Oct 2026
Traffic types: The Piko agent supports HTTP and TCP upstreams, and a Go SDK can create listeners directly from an application. · github.com, 11 Oct 2026
Upstream connections: Upstream services connect outbound to Piko, so they do not need a publicly accessible route. · github.com, 4 Oct 2026
What it does: Piko is a reverse proxy that tunnels traffic to services that are not publicly routable. · github.com, 4 Oct 2026

Where Piko stands on Freedom251

Reverse Proxy Software#31 of 33