Skip to main content

​
Overview

Use role-based access control (RBAC) to restrict what actions each member of your account can take. You can apply RBAC to Users and to an Invitation when you invite a collaborator to join your ngrok account. Configure RBAC from the team members page of the dashboard.

​
Roles

All Users on your account have a Developer, Team, and Billing role. You can also make a User an administrator, which gives them full account control.

​
Developer

The Developer role controls whether a user can create, modify, or delete objects such as Domains, TCP Addresses, Edges, Log Destinations, Authtokens, and API Keys. There are two possible values:
  • Read/Write: A user can create, modify, and delete any developer feature on the account. This doesn’t include team management, billing, or account settings.
  • Read-only: A user can view but not create, modify, or delete developer features on the account. Users with a read-only developer role can still see their personal authtoken and use the ngrok agent to create endpoints for applications.

​
Team

The Team role controls whether a user can invite, remove, and manage other team members. There are three possible values:
  • Manager: A user that can invite and remove other users from the account. They can also modify other users’ RBAC settings. They can’t modify or remove Administrators.
  • Invite-only: A user can see other members of the account and invite new teammates to join the account. They can’t remove other account members or modify the privilege levels of other users.
  • Read-only: A user can see other members of the account but can’t manage or invite other users.

​
Billing

The Billing role controls whether a user can update the account’s billing details and subscription plan. There are two possible values:
  • Billing access: A user can change the subscription plan, payment method, billing address, and other details. Users with this permission can also view billing history.
  • No billing access: A user can’t view or modify any billing details.

​
Administrator

Users with the Administrator role can take all actions within an account. It’s the only role that can configure Account settings like SSO and SCIM. Administrators can remove other administrators from the account. Accounts must always have at least one administrator.

​
Service Users

Service Users hold a smaller set of roles than Users: the read/write or read-only Developer role, and the Manager Team role. New Service Users get the read/write Developer role. Service Users can’t be Administrators or have billing access. See Service Users for details.

​
Additional restrictions with ACLs

You can also use ACLs to limit what an Authtoken or SSH Public Key credential can do in your account. For example, you can restrict which endpoints a credential can listen on.

​
RBAC pricing

RBAC is available on the Pay-as-you-go plan with the SSO & RBAC add-on enabled.