Skip to main content
If you’re exposing endpoints with ngrok, it’s important to keep them safe and secure. One way to protect them is by using OAuth, which requires visitors to sign in to view your app or webpage. This guide walks you through the process of securing your ngrok endpoints with OAuth 2.0. Note: OAuth is included on the ngrok free plan up to 5 monthly active users (MAUs). To secure your applications with OAuth 2.0, you need to create a Traffic Policy file and use the --traffic-policy-file flag:
1

Create a Traffic Policy file

Create a file called oauth-policy.yml:
2

Run your tunnel with the policy file

Run your tunnel with the policy file:
By adding the OAuth flag in the example above, only users who log into GitHub can access your applications. ngrok supports various major OAuth providers such as Google, GitHub, and Microsoft, as well as any solution compatible with OAuth, including OpenID Connect and SAML. This includes Okta, Auth0, and many other identity providers. Learn more about creating custom OAuth applications here. After you add OAuth to secure your application, you may want to further restrict access to specific domains or individual users. The --oauth-allow flags support this granularity. To restrict access by domain, use an expression to check the email domain after the OAuth action:
Then run:
To restrict access by email, use an expression to check if the email is in the allowed list:
Then run:
Besides OAuth 2.0, ngrok offers other access controls such as Webhook Verification, Basic Authentication, IP restrictions, and Mutual TLS. Depending on what you’re building, your combination of these controls may differ.