Secure Your Endpoints with Okta SSO (OpenID Connect)

This guide refers to using SSO to authenticate access to your endpoints. You cannot use these instructions to set up SSO for logging into your ngrok account in the dashboard.

This guide explains how to configure Okta as the primary Identity Provider for ngrok endpoints using single sign-on (SSO). By integrating Okta SSO with ngrok, you can:

Restrict access to your ngrok endpoints to only users authenticated via Okta
Use Okta security policies, multi-factor authentication (MFA) authenticators such as Okta Verify, FastPass, and FIDO2, and ThreatInsights to control access to ngrok endpoints
Use Okta’s Dashboard to facilitate access to ngrok apps

The ngrok integration with Okta supports service provider-initiated (SP-initiated) SSO. In this mode, users access ngrok endpoints and are redirected to Okta for authentication.

What you’ll need

An Okta account with administrative rights to create apps.
An ngrok Pay-as-you-go account with an authtoken or admin access to configure endpoints with OpenID Connect.

1. Configure Okta

Create an OpenID Connect app integration in Okta by following Okta’s guide to creating an app integration. When you configure the application, use these ngrok-specific values:

Sign-in redirect URI: https://idp.ngrok.com/oauth2/callback
Login initiated by: Login initiated by app

After you create the application, open its Sign On tab and copy the Client ID and Client Secret. You use these values when you configure ngrok, along with your Okta org URL as the issuer URL (for example, https://acme.okta.com). Assign the users and groups that need access to the application so those users can sign in through Okta. To test the integration yourself, make sure you’re assigned to the app.

2. Configure ngrok

Use the OpenID Connect Traffic Policy action to enforce Okta authentication on your endpoint.

This step assumes you have an app running locally (for example, on localhost:3000) with the ngrok client installed.

Create a policy.yaml file with the following content, replacing the placeholder values with those copied from Okta:

on_http_request:
  - actions:
      - type: openid-connect
        config:
          issuer_url: 'https://acme.okta.com'
          client_id: 'YOUR_OKTA_CLIENT_ID'
          client_secret: 'YOUR_OKTA_CLIENT_SECRET'
          scopes:
            - openid
            - profile
            - email

Start an ngrok endpoint with this policy, replacing YOUR_DOMAIN with your ngrok domain:

ngrok http 3000 --traffic-policy-file policy.yaml --url YOUR_DOMAIN

Copy the URL next to Forwarding (for example, https://okta-sso-test.ngrok.app).

3. Test the integration

In your browser, launch an incognito window.
Access your ngrok endpoint (for example, https://okta-sso-test.ngrok.app or using a copied URL).
When prompted, log in with your Okta credentials.
After you log in, you see your web app.

General Guides

CLI Credentials

Dashboard SSO

Databases

Endpoints SSO

Event Destinations

Frameworks

JWT Validation

Kubernetes Ingress

OAuth

Protocols

Webhooks

Web Servers

Secure Your Endpoints with Okta SSO (OpenID Connect)

What you’ll need

1. Configure Okta

2. Configure ngrok

3. Test the integration

​What you’ll need

​1. Configure Okta

​2. Configure ngrok

​3. Test the integration

What you’ll need

1. Configure Okta

2. Configure ngrok

3. Test the integration