A login in front of any endpoint. No code changes.
Your users — customers, partners, your own staff — sign in at the ngris edge before a request reaches your service. Google, GitHub, Microsoft, Okta, Auth0 or any OIDC provider, user accounts with roles and invites, JWT, API keys or mTLS. It works the same for an agent tunnel to your laptop and for an app hosted on ngris.
- No SDK, no library
- Tunnels and hosted apps
- Checked before your origin
Checked at the edge, before your service sees a byte
Authentication is a setting on the endpoint, not a library in your app. The edge serves the login page, keeps the session and turns unauthenticated requests away, so the service behind it can stay exactly as it is.
Run ngris http 3000 and share the URL with a client: they sign in with Google or an invite, and nobody else reaches your machine.
Put an admin panel or a Kubernetes service behind your company's Okta or Microsoft login without touching its code.
An app on ngris is an endpoint like any other, so the same login, roles and keys apply. App hosting
Every way your users and clients sign in
Mix them on one endpoint: people use a login page, machines send a token, a key or a client certificate.
OAuth and SSO
Google, GitHub, Microsoft (Azure AD / Entra ID), Okta, Auth0, or any OIDC provider with its issuer, client ID and secret. Turn each provider on or off per endpoint.
User accounts
Email and password accounts that belong to the endpoint, with your password rules: minimum length, upper and lower case, numbers, special characters.
JWT validation
A jwt-validation rule checks tokens your own identity system issues: HS* with a shared secret, RS*, PS* and ES* against a JWKS URL.
API keys
Keys you issue per endpoint, each with an expiry and its own rate limit, with last-used time and request counts. The api-key-validation rule enforces them.
Mutual TLS
Upload trusted client CAs and set the endpoint to optional or required. The require-client-cert rule can also check the certificate's Subject CN, SAN or Issuer CN.
Basic auth
For a quick lock on a tunnel: ngris http 3000 --basic-auth user:pass, repeatable for more than one login.
Users, roles and invites for each endpoint
Decide who may sign in, and what they may do once they're in, from the endpoint's Authentication and RBAC tabs.
- Who can register: open, invite only, or approved by an admin; allow or block email domains; a default role for new users
- Roles with real permissions: methods on paths, like
GET /api/*, each with its own rate limit - Invites, sessions, history: invite by link, suspend a user, see who signed in, revoke one session or all
GET /api/*POST /api/tickets60 req/minInvite userPrivate apps and previews
For apps hosted on ngris there is also a one-switch option: make the production URL, the preview URLs, or both private. Only members of your ngris account get in, after signing in to ngris — handy for a preview you want your team to review but not the world to see.
Locking down many endpoints at once? The dashboard's exposure summary shows which endpoints are open, and bulk settings put a login in front of several in one step.
Frequently asked questions
Do I have to change my application's code?
No. The login is a setting on the endpoint. The ngris edge serves the sign-in page, keeps the session and turns unauthenticated requests away before they reach your service, so the app behind it stays as it is.
Which identity providers can my users sign in with?
Google, GitHub, Microsoft (Azure AD / Entra ID), Okta, Auth0, or any OIDC provider you configure with its issuer, client ID and secret. Users can also have an email and password account on the endpoint, and machines can use JWTs, API keys or client certificates.
Is this the same as signing in to the ngris dashboard?
No. Dashboard SSO is how your team signs in to manage ngris. Edge login protects your own endpoints and apps for the people who use them: your customers, partners or staff, each endpoint with its own users, roles and sign-in methods.
Does it work for a tunnel to my own machine?
Yes. An endpoint served by the ngris agent, on your laptop, a server or in Kubernetes, gets the same login, roles, API keys and mTLS as an app hosted on ngris. Requests that are not signed in never reach your machine.
Can I control who registers and what they can access?
Yes. Choose open registration, invite only, or admin approval; allow or block email domains; and give new users a default role. Each role allows HTTP methods on paths and can carry its own rate limit, and you can suspend users or revoke their sessions at any time.
Lock it down without touching the code.
Start free, expose a service or deploy an app, and put a login in front of it from the endpoint's settings.