Skip to main content
This guide refers to using SSO to authenticate access to your endpoints. You cannot use these instructions to set up SSO for logging into your ngrok account in the dashboard.
This guide explains how to configure FusionAuth as the primary Identity Provider for ngrok endpoints using single sign-on (SSO). By integrating FusionAuth SSO with ngrok, you can:
  • Restrict access to ngrok endpoints only to users authenticated via FusionAuth
  • Use FusionAuth premium features and login methods, including Advanced Registration Forms, Passwordless Login, WebAuthn, and Advanced Threat Detection, to control access to ngrok endpoints
The ngrok integration with FusionAuth supports OIDC-based SSO. In this mode, users access ngrok endpoints and are redirected to FusionAuth for authentication.

​
What you’ll need

  • A public-facing FusionAuth instance (for example, FusionAuth Cloud or a self-hosted installation).
  • An ngrok Pay-as-you-go account with an authtoken or admin access to configure endpoints with OpenID Connect.
  • A local web app or application that needs to be protected by FusionAuth.

​
1. Configure FusionAuth

In your FusionAuth instance, create an application that uses OAuth and OpenID Connect. For the full steps, follow FusionAuth’s Applications guide. While configuring the application, set these values so it works with ngrok:
  • Under Tenants > Your Tenant, set the issuer to the URL of your FusionAuth instance (for example, https://acme.fusionauth.io).
  • On the application’s OAuth tab, enable the Authorization Code and Refresh Token grants.
  • Add https://idp.ngrok.com/oauth2/callback to the Authorized redirect URLs field.
Save the application, then copy the Client Id and Client secret. You use these values to configure ngrok.

​
2. Configure ngrok

Secure your endpoint with the OpenID Connect Traffic Policy action.
This step assumes you have an app running locally (for example, on localhost:3000) with the ngrok agent installed.
Create a policy.yaml file with the following content, replacing the placeholder values with those copied from FusionAuth:
Start an ngrok endpoint with this policy:
Copy the URL next to Forwarding (for example, https://fusionauth-sso-test.ngrok.app).

​
3. Test the integration

  • In your browser, open an incognito window.
  • Access your ngrok endpoint (for example, https://fusionauth-sso-test.ngrok.app or using a copied URL).
  • When prompted, log in with your FusionAuth credentials.
  • After you log in, you see your web app.