> ## Documentation Index
> Fetch the complete documentation index at: https://ngrok.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent Authtokens

> Authenticate an agent with your ngrok account using an authtoken, and use ACLs to scope which endpoints and resources that credential is allowed to use.

The ngrok agent authenticates with an authtoken.
[Your authtoken is available on the ngrok dashboard](https://dashboard.ngrok.com/get-started/your-authtoken).
Add your authtoken to the ngrok agent with the following command:

```bash theme={null}
ngrok config add-authtoken <TOKEN>
```

This command updates the `authtoken` property in your [ngrok configuration file](/docs/gateway/agent/config).

Use a separate authtoken for each agent you configure. You can [provision additional authtokens on your ngrok dashboard](https://dashboard.ngrok.com/authtokens) or [via API](/docs/gateway/agent/config/v3/#authtoken). Separate authtokens isolate the security risk
if an authtoken is compromised. It also allows you to configure
ACLs on a per agent basis.

When you provision a new authtoken, the full token is only displayed once. As a security
feature, ngrok does not store a recoverable representation of the token.

## Authtoken ACLs

Authtoken ACLs restrict what actions an ngrok agent connecting with that
authtoken is allowed to take. You may define multiple ACLs. Authtokens with no
ACLs may take all actions. The following ACLs are supported:

| Example | Description |
| - | - |
| `bind:foo.ngrok.app` | The agent may only create an endpoint on `foo.ngrok.app` |
| `bind:*.example.com` | The agent may only create endpoints on subdomains of `example.com` |
| `bind:foo=bar` | The agent may create a labeled endpoint with the label `foo=bar` |
| `bind:app=*` | The agent may create labeled endpoints with labels like `app=x` or `app=y` |
| `bind:*` | The agent may listen on all endpoints |