Facebook OAuth

​

What you’ll need

• A Facebook Developer account (convert your account to a developer account if needed).
• Your ngrok authtoken and an endpoint with the OAuth action in its Traffic Policy.

​

Create a Facebook app

1. Follow Facebook’s documentation for creating an app, and when prompted to select a use case, choose Authenticate and request data from users with Facebook Login.
2. Connecting a business portfolio is optional. You can skip it, since it isn’t required to authenticate users to your own service.

​

Configure your app for ngrok

• Valid OAuth Redirect URIs: add https://idp.ngrok.com/oauth2/callback in your app’s Facebook Login settings.
• App ID and App Secret: note these from App settings → Basic for use in your Traffic Policy below.
• Mode: switch your app from Development to Live using the toggle at the top of the dashboard. In Development mode, only app admins, developers, and testers can sign in.

​

Update your ngrok endpoint Traffic Policy

1. Access the ngrok Dashboard Endpoints page and locate an existing endpoint you’d like to add this to or create a new one.
2. In your traffic policy, add the following configuration:

on_http_request:
  - actions:
      - type: oauth
        config:
          provider: facebook
          client_id: '{your app''s oauth client id}'
          client_secret: '{your app''s oauth client secret}'
          scopes:
            - email

{
  "on_http_request": [
    {
      "actions": [
        {
          "type": "oauth",
          "config": {
            "provider": "facebook",
            "client_id": "{your app's oauth client id}",
            "client_secret": "{your app's oauth client secret}",
            "scopes": [
              "email"
            ]
          }
        }
      ]
    }
  ]
}

​

Configure access control

on_http_request:
  - expressions:
      - '!(actions.ngrok.oauth.identity.email in [''me@example.com''])'
    actions:
      - type: deny

{
  "on_http_request": [
    {
      "expressions": [
        "!(actions.ngrok.oauth.identity.email in ['me@example.com'])"
      ],
      "actions": [
        {
          "type": "deny"
        }
      ]
    }
  ]
}

​

Further resources

• Handling declined permissions
• App review

​

User permission revocation