Restrict Models and Providers - ngrok documentation

Use an access key configuration to restrict providers and models. Requests outside the allowlist are rejected before they reach an upstream provider.

Allow specific providers

{
  "name": "OpenAI only",
  "access": {
    "providers": { "allow": ["openai"] }
  },
  "router": {
    "rules": [
      { "provider": "openai", "steps": [{ "type": "ngrok" }] }
    ]
  }
}

Assign this configuration to an access key. That key can only reach OpenAI models.

Allow specific models

{
  "name": "Cheap models only",
  "access": {
    "models": {
      "allow": ["openai/gpt-4o-mini", "anthropic/claude-haiku-4-5"]
    }
  }
}

Model IDs use the catalog form author/model, as shown in the model catalog. This form matches the model on every provider that serves it. To pin a provider, prefix it: openai:openai/gpt-4o. See Restrict providers and models.

Block pass-through models

If clients use provider prefixes for uncatalogued models, include only known model IDs in the allowlist. Requests for models not listed are rejected.

Via dashboard

Follow Create a configuration in app.ngrok.ai to set allowed providers and models, then assign the configuration to your access keys.

Next steps

Access Key Configurations: Full reference
Choose a model: Model IDs and provider prefixes
Restrict providers and models: Limit models per key
Securing Your Gateway: Per-client keys