ngrok collapses routing, WAF, observability, failover, and auth into one gateway. Plus, it works the exact same within your VPC, across multiple clouds, on K8s clusters, or from inside a customer’s network.
The agent connects outbound on port 443 , which means no inbound ports, DNS changes, or per-environment gateway. Traffic flows through ngrok’s cloud and out to wherever your services live.
ngrok is your global entry point to anywhere your APIs run. The same agent runs on a laptop, a VM, a Raspberry Pi, an EC2 box, or a Kubernetes cluster.
Block attacks, rate-limit abusers, and authenticate every request at our cloud. Good traffic goes where it should. Bad traffic never reaches your VPC.
One install, one command, anywhere. Agents create unique URLs for each service that’s accessible only through the front door you control in ngrok’s cloud.
Close every port. Because the agent connects outbound, attackers have no way to poke at your origin servers, which remain fully locked down.
Build on an expressive rules system. No more cryptic nginx configs or Lua plugins. Instead, compose rules across teams and offload processing to ngrok’s cloud.
Route to new services, simply. Append a new forward-internal rule to your existing policy and you’re off, no matter where the service runs.
Stop running five tools to do one job. Routing, WAF, rate limiting, auth, and certs all live in one gateway.
Add modern controls to APIs you can’t rewrite. Enforce JWT validation, OAuth, rate limits, and IP rules at our network.
Works the same everywhere your APIs do. AWS, Azure, on-prem, K8s, and customer networks behind one gateway.
Platform owns the front door, teams own their routes. Layered policy that scales from day one.
Pay only for what you use and scale as you grow. It really can be that simple.
This is a real production nginx config from a real developer. They shed a ton of code and complexity on their way to something that's far more expressive and elegant. And yes, you can have this too.
Cloud-provider gateways stop at their own cloud. ngrok installs and runs the exact same way in every environment to put one hostname in front of your services wherever they live.
The agent runs in each cloud and connects outbound. One hostname spans AWS, Azure, and GCP. Endpoint Pools route traffic by region and fail over when a cloud goes down. No DNS headaches or managing a daisy chain of load balancers.
Each cluster runs the ngrok Operator and connects outbound. Route north-south traffic across all of them under one hostname and scale up as easily as adding more replicas of a pod.
The ngrok agent connects outbound from any network and on any hardware, so services once reachable only through a VPN-esque kludge open up to specific identities.
Embed the agent in software you ship. Each customer install becomes a routable origin under one gateway, whether you have one install or ten thousand.
Traffic Inspector replays every request in the dashboard. Export events and metrics to Datadog, CloudWatch, S3, or any JSON-ingesting platform.
Point multiple agents at the same URL to create an Endpoint Pool. ngrok load-balances, fails over to healthy backends, and routes by region.
Use your favorite IaC tooling to provision ngrok primitives. Every endpoint, route, and policy has an API, so you can wire it all up quickly and declaratively.
ngrok provisions and renews certs for every endpoint—no PEM files, no renewal jobs. Terminate TLS at the agent or your upstream to route ciphertext only.
Pick which ngrok regions relay traffic per domain or endpoint to meet data residency requirements.
Most gateways force you to choose between centralized control and team velocity. ngrok lets the right team manage the right policy and composes it all together on our cloud.
Free to start. Three minutes from signup to first request.
A quick tour of the routing, auth, and WAF you’d otherwise wire together yourself.