Secure your endpoints with ngrok’s Basic Auth Traffic Policy, compatible with both interactive and programmatic access to your APIs or apps, in a few minutes.
Securely add production-grade auth with self-service sign-ups, account recovery, and social auth for multiple platforms - integrate ngrok to Auth0.
Aug 3, 2026: We added the missing authtoken step to Get started and updated the CLI examples to match the current agent flags.
Not every app fits the standard auth model of user registration, login forms,
and password resets. Maybe you’re running a quick demo, working with a legacy
system you can’t modify, or just need to lock something down fast.
ngrok’s Traffic Policy system lets you
add authentication to any endpoint in minutes and without touching your
application code.
Let’s walk through how to use Traffic Policy for Basic Auth, OAuth, OpenID
Connect, and JWT validation.
What is Traffic Policy?
Traffic Policy is ngrok’s configuration language for managing traffic in
ngrok’s cloud. You write rules in YAML that filter, validate, and route
requests before they reach your upstream service. Each rule has:
Expressions that match specific conditions (like checking a header or
email domain)
Actions that execute when conditions match (like denying access or
validating a JWT)
You can chain multiple rules together. For authentication, this means you can
validate tokens, restrict access by email domain, and add rate limiting all in
one policy file.
HTTP Basic Auth
The simplest form of authentication prompts visitors for a username and
password before granting access.
Create a YAML file (policy.yaml) with the following Traffic Policy rule:
Basic Auth is great for one-off demos or sharing local work with a co-worker.
For production, move to a more secure method.
OAuth 2.0
OAuth lets users log in with their existing credentials from providers like
Google, GitHub, or Microsoft. They don’t need to use a password, you don’t
have to manage them, and ngrok manages the provider infrastructure so you don’t
have to set one up yourself.
1on_http_request:⋯2 - actions:⋯3 - type: oauth⋯4 config:⋯5 provider: google
When a user accesses your endpoint, they’re redirected to Google to
authenticate, then back to your app. ngrok passes identity information as
headers:
1Ngrok-Auth-User-Email: user@example.com2Ngrok-Auth-User-Id: 1025286123459980489473Ngrok-Auth-User-Name: Jane Developer
To restrict access to specific email domains, add an expression that denies
requests authenticated with any email that does not end with
your-company.com:
Invalid tokens get rejected before hitting your backend. You can also combine
JWT validation with rate limiting keyed to the token for per-consumer limits.
For additional access control, you can also use IP
restrictions to
allowlist trusted sources or
mTLS for
certificate-based authentication on TLS endpoints.
