ngrok: AI & API Gateway | Secure Tunnels & TrafficSkip to main contentngrok homeopen mobile navigationProductProblems We SolveResourcesDocsBlogPricingDownloadLog inSign upProductUniversal GatewaySecure TunnelsAI GatewayTraffic ObservabilityTraffic PolicyKubernetes OperatorDeliveryAPI gatewayAI GatewayWebhook gatewayEphemeral workloadsDevelopmentShare localhostConnect MCPs to AI providersTest webhooksAccess remote K8s clusters from devConnectivitySite-to-site connectivityDevice gatewayRemote accessPlayMinecraftDevelopersDocsQuickstartVideosAPIIntegrationsGitHubStatusResourcesSupportSecurityCase studiesCareersContactBlogBlog homeNative Anthropic SDK support for the AI GatewayMake LLMs 4x smaller and 2x fasterPrompt caching: 10x cheaper LLM tokens, but how?NewIntroducing AI GatewayAll your traffic.One gateway.ngrok is an all-in-one cloud networking platform that secures, transforms, and routes your traffic to services running anywhere.Get started (for free)Read the docsTrusted by teams across the globeDecorationDecorationTry ngrok by sharing a local app. Right now.Choose another platform$ docker pull ngrok/ngrokDownload and setup instructionsDecorationDecorationFrom localhost to live in prod.Instead of a hodgepodge of nginx, NLBs, VPNs, model routers, and Cloudflare, solve every networking problem with one gateway.Share localhostPut your local app on a public URLAPI GatewayDeliver and secure APIsAI GatewayRoute, secure, and transform traffic to any AI modelSign up on ngrok.aiDevice GatewayControl devices in the fieldSite-to-Site ConnectivityConnect to APIs and DBs in customer networksDecorationDecorationDon’t want services addressable on the public internet?Connect to services across clusters, clouds, and environments over private, mTLS-encrypted channels. ngrokd handles service discovery, DNS resolution, and forwarding so your traffic never leaves ngrok's infrastructure. Sound like a perfect fit?Get startedTalk to an engineerDecorationDecorationYou may also need to…Handle webhooks for production servicesAssign secure URLs to previews and CI testsSSH and RDP into devices in the fieldAccess remote K8s clusters from devConnect your local MCP server to ChatGPT and ClaudeReplay HTTP requests to debug webhooks fasterMore problems we solveDecorationDecorationOkay, but how does it work?Connect anything with Endpoints, Traffic Policy, and Secure Tunnels.DecorationDecorationEndpoints & Traffic PolicyRoute, transform, and authenticate your traffic.No more cryptic nginx configs or Lua plugins. Everything is a URL with traffic rules you attach. Compose them together and offload processing to ngrok’s cloud gateway.Fig. 1 – Traffic flows through Endpoints & Traffic PolicyTake action at any phase in the request lifecycle.Traffic Policy is an expressive CEL-based rules system. When a request hits different phases of its lifecycle, ngrok executes each rule sequentially.Fig. 2 – Traffic policy examplesRoute by any request propertyEnforce OAuth in front of your appsBlock by IP reputation and geoStop bad actors with rate limits, WAFCopy code1on_http_request:⋯2 # send requests with the /api path prefix to the api service3 - expressions:⋯4 # conditions are CEL expressions, see https://cel.dev5 - req.url.path.startsWith(’/api’)6 actions:⋯7 - type: forward-internal⋯8 config:⋯9 url: https://api.internal10 11 # route dynamically based on a header using CEL interpolation12 - actions:⋯13 - type: forward-internal⋯14 config:⋯15 url: https://${req.headers(’X-Custom-Header’)}.internalEven more ways to control and transform your trafficExplore actionsMutual TLSOAuth + OIDCBasic AuthURL rewrite + redirectsModify headersCustom responseIP restrictionsWebhook verificationStop cobbling your infrastructure together.Security, performance, and resiliency built in by default.Load BalancingTurn one URL into a smart pool of replicasScale automatically by starting endpoints with the same URL. They self-register for load balancing. Stop them and they’re out.Global NetworkAccelerate traffic with smart global routingWe reduce latency for your end users by routing every request across our global network to the nearest healthy replica.DDoS ProtectionProtect origins from DDoS with no extra workngrok automatically blocks volumetric attacks from malicious actors before any traffic reaches your network.Any ProtocolServe HTTP, TLS, and TCP with native supportIf it runs over TCP, it works on ngrok. Websockets, gRPC, SSH, Postgres, MQTT, even Minecraft… you get the idea.More about endpointsMore about Traffic PolicySecure TunnelsConnect to services anywhere, no firewall changes required.Install a lightweight agent to deliver traffic to any service through a secure tunnel.Fig. 3 – Anatomy of a secure tunnelEnvironment AgnosticRun your services in any environmentBecause your services are connected to ngrok with secure tunnels, they can be deployed anywhere. If it listens on a port and is connected to the internet, ngrok can deliver traffic to it.Zero Open PortsClose every single inbound portAttackers can't skirt a secure tunnel to scan or attack your origin servers, which means you whittle down your surface area and remove an entire class of attack vectors.Least Privileged AccessPrecise network access, not risky customer VPNsDrop the ngrok agent into your customers' networks and tightly scope your access to just the APIs and databases you need. Not their whole subnet.Native SDKsimport "ngrok"Don't want to package and babysit an agent sidecar? Embed secure tunnels directly into your code with a native agent SDK.More about secure tunnelsSweatin' the small stuffDeveloper experience matters.Traffic InspectorInspect every detail of your trafficWatch the flow in real time, then dig into the headers, body, latency, response, and more for every request.Log ExportSend traffic logs to your favorite obs platformExport structured logs to Datadog, Cloudwatch, and Azure Monitor to combine with your existing telemetry.Kubernetes OperatorUse your existing Kubernetes manifestsThe ngrok Operator slurps up standardized Ingress and Gateway API resources, then transforms them into endpoints and policies that run on our cloud service and deliver traffic to your pods.APIs & IntegrationsFully programmableWe integrated ngrok into the dev tools you love. There's an API for every feature to quicky build your own integrations, too. And make them production-ready, declarative, IaC... you get the idea.Multi-platform CLIAgent SDKsDocker Desktop appAPI client librariesDocker imagesTerraform providerKubernetes OperatorCompliance & SecurityAll the boxes you need to checkTrust CenterSOC2 Type IIHIPAA & BAAGDPRCCPAEU-US DPFRBACSSO & SCIMAudit logsData residencyWhite-labelingJoin millions of developers routing billions of requests every day.Scott Motte@motdotlangrok is so effing amazingIhor LeshkoDirector of Engineeringngrok opened the door for Databricks to rapidly onboard big enterprise customers with comprehensive security much less operational complexity.Kevin Simper@kevinsimperI wouldn't know how to work without ngrok.Lyzi Diamond@lyzidiamondOMG life changer. I can't imagine how I lived without ngrok.Wesley GormanSenior Director, Engineering, Zendeskngrok has been super user friendly, works seamlessly, and never gets in our way. Today, our engineers spend less time troubleshooting proxy issues and more time building.Brian Ketelsen@bketelsenJust used ngrok for the first time to show off a new GopherCon web layout. Wow, that's awesome.Cassidy Williams@cassidoongrok saves me so much time during development. What a tool.Austin CottrellCloud Infrastructure Engineerngrok continues to wow us with great APIs and automation. Establishing secure remote connectivity with our customer's environments via REST APIs is fast and safe ... and amazing!Steve Kinney@stevekinneyngrok makes the hard parts of networking feel effortless.Scott Motte@motdotlangrok is so effing amazingIhor LeshkoDirector of Engineeringngrok opened the door for Databricks to rapidly onboard big enterprise customers with comprehensive security much less operational complexity.Kevin Simper@kevinsimperI wouldn't know how to work without ngrok.Brian Cantrell@briancantrellngrok is making my life so much better.Kent C. Dodds@kentcdoddsJust got introduced to #ngrok by @geddski. This thing's amazing.Lorna Mitchell@lornajaneI have literally no idea how I solved many of these problems before I used ngrokLyzi Diamond@lyzidiamondOMG life changer. I can't imagine how I lived without ngrok.Wesley GormanSenior Director, Engineering, Zendeskngrok has been super user friendly, works seamlessly, and never gets in our way. Today, our engineers spend less time troubleshooting proxy issues and more time building.Brian Ketelsen@bketelsenJust used ngrok for the first time to show off a new GopherCon web layout. Wow, that's awesome.Gajus@kuizinasHoly smokes, ngrok is incredible. This is going to change my workflow forever.georges@multiplegeorgesngrok is so useful that I actually enjoy paying for it.Yehuda Katz@waborwycatzngrok is one of those tools that you don't realize you need until you try it. Then it's indispensable.Cassidy Williams@cassidoongrok saves me so much time during development. What a tool.Austin CottrellCloud Infrastructure Engineerngrok continues to wow us with great APIs and automation. Establishing secure remote connectivity with our customer's environments via REST APIs is fast and safe ... and amazing!Steve Kinney@stevekinneyngrok makes the hard parts of networking feel effortless.Kareem@kareemsinchinngrok is the api gateway goat honestlyBree Hoffman@breefieldngrok is genius, replaying requests makes webhooks 1M times easier to handle.Peter Vukovic@pvukovicSpent 3 hours looking for a good ngrok alternative. Let me save you some time: there isn't a better ngrok alternative.Scott Motte@motdotlangrok is so effing amazingIhor LeshkoDirector of Engineeringngrok opened the door for Databricks to rapidly onboard big enterprise customers with comprehensive security much less operational complexity.Kevin Simper@kevinsimperI wouldn't know how to work without ngrok.Brian Cantrell@briancantrellngrok is making my life so much better.Kent C. Dodds@kentcdoddsJust got introduced to #ngrok by @geddski. This thing's amazing.Lorna Mitchell@lornajaneI have literally no idea how I solved many of these problems before I used ngrokLyzi Diamond@lyzidiamondOMG life changer. I can't imagine how I lived without ngrok.Wesley GormanSenior Director, Engineering, Zendeskngrok has been super user friendly, works seamlessly, and never gets in our way. Today, our engineers spend less time troubleshooting proxy issues and more time building.Brian Ketelsen@bketelsenJust used ngrok for the first time to show off a new GopherCon web layout. Wow, that's awesome.Gajus@kuizinasHoly smokes, ngrok is incredible. This is going to change my workflow forever.georges@multiplegeorgesngrok is so useful that I actually enjoy paying for it.Yehuda Katz@waborwycatzngrok is one of those tools that you don't realize you need until you try it. Then it's indispensable.Cassidy Williams@cassidoongrok saves me so much time during development. What a tool.Austin CottrellCloud Infrastructure Engineerngrok continues to wow us with great APIs and automation. Establishing secure remote connectivity with our customer's environments via REST APIs is fast and safe ... and amazing!Steve Kinney@stevekinneyngrok makes the hard parts of networking feel effortless.Kareem@kareemsinchinngrok is the api gateway goat honestlyBree Hoffman@breefieldngrok is genius, replaying requests makes webhooks 1M times easier to handle.Peter Vukovic@pvukovicSpent 3 hours looking for a good ngrok alternative. Let me save you some time: there isn't a better ngrok alternative.See more loveYou're using ngrok right now.ngrok received your request on our global network, filtered it through our WAF, applied a rate limit, routed it to our services, and delivered this web page to your browser.Fig. 4 – ngrok.com's Traffic PolicyCopy code1on_http_request:⋯2 # say bye to anonymous proxies3 - expressions:⋯4 - "’proxy.anonymous’ in conn.client_ip.categories"5 actions:⋯6 - type: deny7 8 # rate limit requests by IP, unless you’re a search/AI bot crawling the docs9 - expressions:⋯10 - "!(’com.openai.gptbot.ipv4’ in conn.client_ip.categories || ’com.google.googlebot.ipv4’ in conn.client_ip.categories)"11 - "!req.url.path.startsWith(’/docs’)"12 actions:⋯13 - type: rate-limit⋯14 config:⋯15 algorithm: sliding_window16 bucket_key:⋯17 - conn.client_ip18 capacity: 1234519 enforce: false20 name: Limit 12345 requests per minute per ip and user agent21 rate: 60s22 23 # rate limit violators get their connection closed instead of 429 errors24 - expressions:⋯25 - actions.ngrok.rate_limit.limited26 actions:⋯27 - type: close-connection28 29 # this is our WAF, dawg30 - actions:⋯31 - type: owasp-crs-request⋯32 config:⋯33 exclude_rule_ids:⋯34 - 93226035 on_error: continue36 process_body: true37 38 # log all WAF decisions in our observability platform and then deny anomalous requests39 - expressions:⋯40 - actions.ngrok.owasp_crs_request.decision == ’deny’41 actions:⋯42 - type: log⋯43 config:⋯44 metadata:⋯45 action: waf deny46 anomaly_score: ${actions.ngrok.owasp_crs_request.anomaly_score}47 first_matched_data: ${actions.ngrok.owasp_crs_request.matched_rules[0].data}48 first_matched_id: ${actions.ngrok.owasp_crs_request.matched_rules[0].id}49 first_matched_message: ${actions.ngrok.owasp_crs_request.matched_rules[0].message}50 first_matched_severity: ${actions.ngrok.owasp_crs_request.matched_rules[0].severity}51 ngrok_error_message: ${actions.ngrok.owasp_crs_request.error.message}52 phase: request53 - type: deny54 55 # block countries to comply with legal requirements56 - expressions:⋯57 - conn.geo.country_code in [’ABC’, ’DEF’, ’XYZ’]58 actions:⋯59 - type: deny60 61 # "we’re hiring" easter egg for the curious developer62 - actions:⋯63 - type: add-headers⋯64 config:⋯65 headers:⋯66 x-ngrok-we-are-hiring: https://ngrok.com/careers67 68 # add a custom security.txt file without storing it in s3 or something69 - expressions:⋯70 - req.url.uri.contains(’/.well-known/security.txt’)71 actions:⋯72 - type: custom-response⋯73 config:⋯74 content: |+⋯75 Contact: mailto:security@ngrok.com76 Canonical: https://ngrok.com/.well-known/security.txt77 Policy: https://ngrok.com/security/disclosure-and-reward-program78 Hiring: https://ngrok.com/careers79 Preferred-Languages: en80 Expires: 2026-11-01T00:00:00Z81 headers:⋯82 Content-Type: text/plain; charset=utf-883 status_code: 20084 85 # redirect legacy /downloads path to /download86 - actions:⋯87 - type: redirect⋯88 config:⋯89 from: https://ngrok.com/downloads(/|$)(.*)90 status_code: 30191 to: https://ngrok.com/download/$292 93 # redirect legacy blog path+slug94 - expressions:⋯95 - req.url.path.startsWith(’/blog-post’)96 actions:⋯97 - type: redirect⋯98 config:⋯99 from: ^(https?://[^/]+)/blog-post/(.*)$100 status_code: 301101 to: $1/blog/$2102 103 # handle /docs by forwarding traffic to our docs hosted in s3104 - expressions:⋯105 - req.url.path.startsWith(’/docs’)106 actions:⋯107 - type: forward-external⋯108 config:⋯109 url: https://ngrok.docs-provider.com110 111 # handle /blog and asset paths by forwarding traffic to an external provider112 # sorry, we gotta be a little cheeky with these113 - expressions:⋯114 - ’["/__blog-manifest","/blog-assets","/blog"].exists(p,req.url.path.startsWith(p))’115 actions:⋯116 - type: forward-external⋯117 config:⋯118 url: https://blog.deployment-provider.com119 120 # handle /, /download, /pricing/, and other paths by forwarding to the same provider, different deployment121 - expressions:⋯122 - ’["/__manifest","/assets","/download","/pricing","/schemas"].exists(p,req.url.path.startsWith(p))’123 actions:⋯124 - type: forward-external⋯125 config:⋯126 url: https://frontend.deployment-provider.com127 128 # legacy website paths forward to cms129 - actions:⋯130 - type: url-rewrite⋯131 config:⋯132 from: /(.+)/$133 to: /$1134 - type: forward-external⋯135 config:⋯136 url: https://ngrok.cms-provider.com137 138on_http_response:⋯139 # run waf on all responses140 - actions:⋯141 - type: owasp-crs-response⋯142 config:⋯143 on_error: continue144 process_body: true145 146 # as before, log all those WAF decisions and deny responses147 - expressions:⋯148 - actions.ngrok.owasp_crs_response.decision == ’deny’149 actions:⋯150 - type: log⋯151 config:⋯152 metadata:⋯153 action: waf deny154 anomaly_score: ${actions.ngrok.owasp_crs_response.anomaly_score}155 first_matched_data: ${actions.ngrok.owasp_crs_response.matched_rules[0].data}156 first_matched_id: ${actions.ngrok.owasp_crs_response.matched_rules[0].id}157 first_matched_message: ${actions.ngrok.owasp_crs_response.matched_rules[0].message}158 first_matched_severity: ${actions.ngrok.owasp_crs_response.matched_rules[0].severity}159 ngrok_error_message: ${actions.ngrok.owasp_crs_response.error.message}160 phase: response161 - type: custom-response⋯162 config:⋯163 content: 403 Forbidden164 headers:⋯165 Content-Type: text/plain; charset=utf-8166 status_code: 403See MoreDecorationDecorationYou read the whole page. What are you waiting for?No upfront costs. No contact sales. Pay only for what you use.Start BuildingSee pricingDecorationDecoration