Skip to main content
This guide refers to using SSO to authenticate access to your endpoints. You cannot use these instructions to set up SSO for logging into your ngrok account in the dashboard.
This guide walks you through configuring Curity as the primary Identity Provider for ngrok endpoints using single sign-on (SSO). By integrating Curity Identity Server with ngrok, you can:
  • Restrict access to ngrok endpoints to only users who authenticated via Curity
  • Use Curity security policies and multi-factor authentication (MFA) authenticators, including BankId, SITHS, and WebAuthn, to control access to ngrok endpoints
  • Use Curity’s Dashboard to facilitate access to ngrok apps

​
What you’ll need

  • A Curity account with administrative rights to create clients.
  • An ngrok Pay-as-you-go account with an authtoken or admin access to configure endpoints with OpenID Connect.

​
1. Configure Curity

In the Curity Identity Server admin UI, create an OAuth client that uses the code flow and OpenID Connect. For the full steps, including setting up an authenticator and generating a client secret, follow Curity’s Configure a Client tutorial. While configuring the client, set these values so it works with ngrok:
  • Add https://idp.ngrok.com/oauth2/callback as a Redirect URI.
  • Under Client Authentication, select secret and generate a secret. Copy the secret, since you can’t retrieve it later.
  • Under Scopes and Claims, add the openid scope.
  • On the Token Service > General page, enable the Expose Metadata toggle. ngrok calls the /.well-known/openid-configuration endpoint at Curity to pull the configuration for your Authorization Server.
Commit the changes via the Changes menu, then copy the Client ID and Client Secret. You use these values, along with your Curity issuer address (for example, https://acme.com/oauth/v2/oauth-anonymous), to configure ngrok.

​
2. Configure ngrok

Secure your endpoint with the OpenID Connect Traffic Policy action.
This step assumes you have an app running locally (for example, on localhost:3000) with the ngrok agent installed.
Create a policy.yaml file with the following content, replacing the placeholder values with those copied from Curity Identity Server:
Start an ngrok endpoint with this policy:
Copy the URL next to Forwarding (for example, https://curity-sso-test.ngrok.app).

​
3. Test the integration

  • In your browser, open an incognito window.
  • Access your ngrok endpoint (for example, https://curity-sso-test.ngrok.app or using a copied URL).
  • When prompted, log in with your Curity credentials.
  • After you log in, you see your web app.