Built by Metorial, the integration platform for agentic AI.
Retrieve details of a specific TLS certificate including subject, validity, and issuer information.
List all SSH public keys registered for tunnel authentication. SSH credentials authorize SSH reverse tunnel connections.
Create a new API key for authenticating with the ngrok API. **Important:** The token value is only returned once at creation time — save it immediately.
List all active tunnel sessions. Sessions represent running ngrok agent or SSH reverse tunnel connections. Each session can include multiple tunnels.
Retrieve details of a specific active tunnel, including its public URL, protocol, and where it forwards traffic.
Create an event destination for publishing captured events. The target must be exactly one of: **kinesis**, **firehose**, **cloudwatch_logs**, **datadog**, or **azure_logs_ingestion**. Each target type has its own configuration format.
List all SSH certificate authorities. SSH CAs are key pairs used to sign SSH host and user certificates.
Update a secret's name, value, description, or metadata.
Retrieve details of a specific tunnel credential (authtoken) by ID.
List all IP policy rules across all policies. Rules are individual CIDR entries with allow or deny actions.
List all reserved TCP addresses. Reserved addresses provide stable TCP endpoints for non-HTTP services like SSH or databases. The hostname and port are assigned by ngrok.
List all tunnel credentials (authtokens). Authtokens authorize ngrok agents to connect to the ngrok service. ACL rules can restrict which domains, addresses, or labels each token can bind.
Retrieve details of a specific IP policy by ID.
Delete a TLS certificate. It must be detached from all domains first.
Create a new bot user (service account) for programmatic API access. After creation, assign API keys or authtokens to the bot user.
List all event subscriptions. Event subscriptions capture audit and traffic events and publish them to configured destinations (CloudWatch, Kinesis, Firehose, Datadog, or Azure Logs).
List all active endpoints. Endpoints define how traffic is routed to your services. Includes cloud endpoints and active agent or edge endpoints.
Update a bot user's name or active status.
List all bot users (service accounts). Service users, formerly bot users, provide programmatic API access through the current Service Users API, separate from human user accounts. API keys and authtokens can be assigned to bot users.
Delete an IP policy and all its associated rules.
Reserve a new TCP address for non-HTTP traffic. The hostname and port are assigned by ngrok and cannot be chosen. Useful for SSH, database connections, or other TCP services.
Remove a CIDR rule from an IP policy.
Upload a CA certificate for mutual TLS authentication. The CA will be used to verify client certificates presented during mTLS connections.
Retrieve details of a specific endpoint by ID, including its traffic routing configuration and associated tunnel or domain.
Create an event subscription to capture audit or traffic events. Specify which event types to capture (sources) and where to send them (destination IDs). Create event destinations first using the "Create Event Destination" tool. Common audit event types: `api_key_created.v0`, `ip_policy_created.v0`, `ip_policy_updated.v0` Common traffic event types: `http_request_complete.v0`, `tcp_connection_closed.v0`
Reserve a new domain (hostname) for receiving HTTP, HTTPS, or TLS traffic. You can use your own domain by creating a CNAME record. Optionally configure automatic TLS certificate management via Let's Encrypt or attach a custom certificate.
List all event destinations. Destinations define where captured events are published (CloudWatch Logs, Kinesis, Firehose, Datadog, or Azure Logs Ingestion).
Add a CIDR rule to an IP policy. Each rule specifies a CIDR range and whether to allow or deny traffic from that range.
Create a new tunnel credential (authtoken) for ngrok agent authentication. **Important:** The token value is only returned at creation time. Optionally restrict the token with ACL bind rules.
Update a tunnel credential's description, metadata, or ACL rules.
Retrieve details of a specific reserved domain by its ID. Returns the full domain configuration including certificate and DNS settings.
List all API keys for your ngrok account. API keys authenticate requests to the ngrok REST API.
Delete an API key. Requests using this key will no longer be authenticated.
Create a new vault to organize secrets. Secrets can then be stored within the vault.
Create a persistent cloud endpoint with a URL and traffic policy. Public bindings make the endpoint reachable from the internet. Cloud endpoints do not require a running agent and may incur provider charges.
Update an existing endpoint's URL, traffic policy, description, metadata, or bindings.
Retrieve a connected agent or SSH session by ID, including the credential and metadata needed to identify it before issuing lifecycle commands.
Delete an event destination. It must not be referenced by any event subscription.
Retrieve details of a specific event subscription including its sources and destinations.
List all active tunnels. Tunnels are created by running ngrok agents and provide public endpoints to access your local services. This is a read-only listing.
List all certificate authorities (CAs) used for mutual TLS (mTLS) authentication. CAs verify that client TLS certificates were signed by a trusted authority.
Delete a vault. Remove its owned secrets first; the provider may reject deletion of a nonempty vault.
Delete a secret from its vault.
Update an event subscription's sources, destinations, description, or metadata.
Update a vault's name, description, or metadata.
List all vaults. Vaults organize secrets used across your ngrok resources.
Release a reserved TCP address. It will no longer receive traffic.
Delete a certificate authority. It must not be in use by any mTLS module.
Update an IP policy's description or metadata.
Update an existing reserved domain's description, metadata, or certificate configuration.
Retrieve details of a specific API key. Note: the token value is only available at creation time.
Delete a tunnel credential. Agents using this authtoken will no longer be able to connect.
Release a reserved domain. The domain will no longer receive traffic and will become available for re-reservation.
List all uploaded TLS certificates. TLS certificates can be attached to reserved domains to terminate TLS traffic.
Register an SSH public key for tunnel authentication. The key can optionally be restricted with ACL bind rules.
Create a new secret in a vault. Secrets store sensitive values used across your ngrok resources.
Create a new SSH certificate authority key pair for signing SSH host and user certificates.
List all reserved domains on your ngrok account. Reserved domains are hostnames you can listen for HTTP, HTTPS, or TLS traffic on. Supports pagination.
Create a new IP policy. After creating a policy, add CIDR rules to it using the "Add IP Policy Rule" tool, then apply the policy to restrict access to endpoints, API, agent connections, or the dashboard.
List all secrets across all vaults. Secret values are not returned in the listing.
Retrieve details of a specific bot user (service account) by ID.
Delete a bot user. All API keys and authtokens owned by this bot user will be revoked.
Delete an event subscription. Events will no longer be captured and published.
Restart an ngrok agent tunnel session. Uses exec() to restart the agent process. Not supported on Windows agents.
Delete an SSH credential. SSH connections using this key will no longer be authenticated.
Retrieve details of a specific reserved TCP address by its ID.
Delete a cloud endpoint. This will stop routing traffic to this endpoint.
Update the description or metadata of a reserved TCP address.
List all IP policies. IP policies are reusable groups of CIDR ranges with allow or deny actions that can restrict access to your API, agent connections, or endpoints.
Update an API key's description or metadata.
Delete an SSH certificate authority from this account. Previously signed certificates retain their cryptographic validity until expiry or a trust configuration change.
Upload a TLS certificate and private key pair. The certificate must be PEM-encoded with the leaf certificate first. After upload, attach to a reserved domain.
Stop an ngrok agent tunnel session. This will terminate all tunnels associated with the session.