> ## Documentation Index
> Fetch the complete documentation index at: https://ngrok.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon OAuth

> Configure ngrok to authenticate users with Amazon OAuth (Login with Amazon) for websites and apps.

This guide walks you through configuring ngrok to use Amazon OAuth (Login with Amazon) for user authentication.
The steps below follow Amazon's [Register for Login with Amazon](https://developer.amazon.com/docs/login-with-amazon/register-web.html) documentation for websites.

## What you'll need

* Your [Amazon Developer account](https://developer.amazon.com/loginwithamazon/console/site/lwa/overview.html) (sign up if you don't have one).
* Your ngrok authtoken and an endpoint with the OAuth action in its Traffic Policy.

## Create a security profile for ngrok

Follow [Amazon's documentation for registering with Login with Amazon](https://developer.amazon.com/docs/login-with-amazon/register-web.html) to create a security profile in the [Login with Amazon](https://developer.amazon.com/loginwithamazon/console/site/lwa/overview.html) portal, then set the following in the profile's web settings:

* **Allowed Return URLs**: add `https://idp.ngrok.com/oauth2/callback`.

Note the security profile's **Client ID** and **Client Secret** for use in your Traffic Policy below.

## Update your ngrok endpoint Traffic Policy

1. Access the [ngrok Dashboard Endpoints page](https://dashboard.ngrok.com/endpoints?sortBy=createdAt\&orderBy=desc) and locate an existing endpoint you'd like to add this to or create a new one.
2. In your traffic policy, add the following configuration:

<Note>
  You may add [any scopes](https://developers.facebook.com/docs/apps/review/login-permissions) that are required by your application with the following caveats.

  * Scopes which require a Facebook [app review](https://developers.facebook.com/docs/apps/review/#app-review) are unsupported.
  * ngrok will enforce that users [accept all permissions](https://developers.facebook.com/docs/facebook-login/handling-declined-permissions#reprompt) before completing authorization.
</Note>

<CodeGroup>
  ```yaml policy.yml theme={null}
  on_http_request:
    - actions:
        - type: oauth
          config:
            provider: amazon
            client_id: '{your app''s oauth client id}'
            client_secret: '{your app''s oauth client secret}'
            scopes:
              - profile
  ```

  ```json policy.json  theme={null}
  {
    "on_http_request": [
      {
        "actions": [
          {
            "type": "oauth",
            "config": {
              "provider": "amazon",
              "client_id": "{your app's oauth client id}",
              "client_secret": "{your app's oauth client secret}",
              "scopes": [
                "profile"
              ]
            }
          }
        ]
      }
    ]
  }
  ```
</CodeGroup>

Click **Save** to validate and update your traffic policy.

### Configure access control

Optionally, configure access control to your service by only allowing specific users or domains.

<CodeGroup>
  ```yaml policy.yml theme={null}
  on_http_request:
    - expressions:
        - '!(actions.ngrok.oauth.identity.email in [''me@example.com''])'
      actions:
        - type: deny
  ```

  ```json policy.json theme={null}
  {
    "on_http_request": [
      {
        "expressions": [
          "!(actions.ngrok.oauth.identity.email in ['me@example.com'])"
        ],
        "actions": [
          {
            "type": "deny"
          }
        ]
      }
    ]
  }
  ```
</CodeGroup>

## Further resources

* [Login with Amazon Documentation](https://developer.amazon.com/docs/login-with-amazon/documentation-overview.html)
* [Login with Amazon for Websites Overview](https://developer.amazon.com/docs/login-with-amazon/web-docs.html)