Skip to main content
This guide walks you through configuring ngrok to use Amazon OAuth (Login with Amazon) for user authentication. The steps below follow Amazon’s Register for Login with Amazon documentation for websites.

​
What you’ll need

  • Your Amazon Developer account (sign up if you don’t have one).
  • Your ngrok authtoken and an endpoint with the OAuth action in its Traffic Policy.

​
Create a security profile for ngrok

  1. Navigate to the Login with Amazon portal and sign in with your Amazon Developer credentials.
If you don’t have a developer account, you’ll need to sign up for a new one.
  1. Click Create a New Security Profile, provide a Name and a Description for your security profile, enter your application’s privacy URL (for example, https://ngrok.com/privacy) in the Consent Privacy Notice URL, and then click Save.
  2. Click Show Client ID and Client Secret to reveal your Client ID and Client Secret and make a note of both.
  3. Hover over the gear icon of the Security Profile you created and then click Web Settings.
  4. On the Security Profile page, click Edit, enter https://idp.ngrok.com/oauth2/callback in the Allowed Return URLs field, and then click Save.

​
Update your ngrok endpoint Traffic Policy

  1. Access the ngrok Dashboard Endpoints page and locate an existing endpoint you’d like to add this to or create a new one.
  2. In your traffic policy, add the following configuration:
You may add any scopes that are required by your application with the following caveats.
on_http_request:
  - actions:
      - type: oauth
        config:
          provider: amazon
          client_id: '{your app''s oauth client id}'
          client_secret: '{your app''s oauth client secret}'
          scopes:
            - profile
Click Save to validate and update your traffic policy.

​
Configure access control

Optionally, configure access control to your service by only allowing specific users or domains. 
on_http_request:
  - expressions:
      - '!(actions.ngrok.oauth.identity.email in [''me@example.com''])'
    actions:
      - type: deny

​
Further resources