Skip to main content
This guide refers to using SSO to authenticate access to your endpoints. You cannot use these instructions to set up SSO for logging into your ngrok account in the dashboard.
This guide explains how to configure Descope as the primary Identity Provider for your ngrok endpoints using single sign-on (SSO). By integrating Descope SSO with ngrok, you can:
  • Restrict access to ngrok endpoints only to users authenticated via Descope
  • Use Descope security policies and multi-factor authentication (MFA) authenticators
  • Use the Descope Console to facilitate access to ngrok apps
The ngrok integration with Descope supports service provider-initiated (SP-initiated) SSO. In this mode, users access ngrok endpoints and are redirected to Descope for authentication.

​
What you’ll need

  • A Descope account with administrative rights to a Descope Project.
  • An ngrok Pay-as-you-go account with an authtoken or admin access to configure endpoints with OpenID Connect.

​
1. Configure Descope

In the Descope Console, create an OIDC application so Descope can act as the identity provider for ngrok. For the full steps, follow Descope’s OIDC Federated Applications guide. Gather the following values to configure ngrok:
  • Issuer URL: shown on the application page after you create the OIDC application.
  • Client ID: your Descope Project ID, found under Project Settings in the Descope Console.
  • Client Secret: a Descope Access Key. Go to Access Keys, click + Access Key, name it ngrok, set an expiration, and click Generate Key. Copy the key, since it’s shown only once.

​
2. Configure ngrok

Secure your endpoint with the OpenID Connect Traffic Policy action.
This step assumes you have an app running locally (for example, on localhost:3000) with the ngrok agent installed.
Create a policy.yaml file with the following content, replacing the placeholder values with those copied from Descope:
Start an ngrok endpoint with this policy:
Copy the URL next to Forwarding (for example, https://descope-sso-test.ngrok.app).

​
3. Test the integration

  • In your browser, open an incognito window.
  • Access your ngrok endpoint (for example, https://descope-sso-test.ngrok.app or using the copied URL).
  • When prompted, log in with Descope.
  • After you log in, you see your web app.