ngrok OpenAPI
Official vendor OpenAPI document · agent-readyCloud InfrastructureNetworkingBearer Token241 EndpointsREST
For Agents
Create secure tunnels to expose local services, manage edge configurations, and handle traffic routing with authentication and policy enforcement.
Use for: Expose a local development server to the internet for webhook testing, Create a secure tunnel to share a localhost application with a remote team, Set up custom domain routing for an exposed service, List all active tunnel sessions and their connection status
Not supported: Does not handle application hosting, code deployment, or service mesh functionality - use for network ingress and tunnel management only.
Securely expose local services to the internet through managed tunnels and edges. ngrok provides programmable ingress for applications, enabling developers to expose localhost servers, create secure webhooks, and manage traffic routing without deploying infrastructure. The platform handles TLS termination, load balancing, authentication, and observability for incoming connections.
Install Jentic One Beta
Connect the ngrok OpenAPI to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the ngrok OpenAPI, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fngrok.com%2Fngrok" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fngrok.com%2Fngrok" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with ngrok OpenAPI API.
Create and manage secure tunnels to expose local services to the internet
Configure HTTPS and TCP edges with custom domains and certificates
Enforce IP restrictions and authentication policies on incoming traffic
Route requests through backends with failover and weighted load balancing
Monitor and manage active tunnel sessions and endpoints
Store and rotate API credentials and secrets in encrypted vaults
Subscribe to webhook events for tunnel and endpoint lifecycle changes
Use Cases
Patterns agents use ngrok OpenAPI API for, with concrete tasks.
★ Webhook Development and Testing
Expose localhost servers to receive webhooks from external services during development. ngrok creates a public HTTPS URL that forwards requests to your local application, enabling real-time testing of Stripe, GitHub, or Twilio webhooks without deploying to staging. Tunnel sessions persist across restarts and support request inspection.
Create a tunnel session for localhost:3000 with a reserved domain and subscribe to webhook events for tunnel status changes
Remote Access to Local Services
Share local applications with remote teams or clients without deploying to a public server. ngrok creates secure tunnels with optional authentication and IP restrictions, making it safe to expose staging environments or preview builds. Supports both HTTP and TCP protocols.
Create an HTTPS edge with OAuth authentication and IP whitelist for team access to a local service on port 8080
Custom Domain Ingress Management
Route traffic from custom domains to local or cloud services through ngrok edges. Reserve domains, configure TLS certificates, and apply traffic policies like circuit breakers and request header modifications. Useful for multi-tenant applications or dynamic service routing without managing infrastructure.
Reserve the domain api.example.com, create an HTTPS edge with TLS termination, and configure a weighted backend to route traffic 80/20 between two tunnel endpoints
Secure IoT Device Access
Expose IoT devices or embedded systems behind NAT or firewalls without opening inbound ports. ngrok's TCP and TLS edges enable secure remote access to devices for monitoring, updates, or support. Supports SSH, MQTT, and custom TCP protocols.
Create a TCP edge on port 22 to provide SSH access to a Raspberry Pi behind NAT, with IP restriction to allow connections only from the admin network
AI Agent Integration for Tunnel Orchestration
Automate tunnel creation, edge configuration, and traffic policy enforcement through AI agents using Jentic. Agents can dynamically provision ingress for ephemeral environments, respond to webhook events, and enforce security policies based on runtime context. Jentic handles credential isolation and schema discovery.
Use Jentic to search for 'create a secure tunnel', load the ngrok tunnel creation schema, and execute a request to expose a local service on port 5000 with IP whitelisting
Key Endpoints
241 endpoints — securely expose local services to the internet through managed tunnels and edges.
METHOD
PATH
DESCRIPTION
POST
/tunnels
Create a tunnel session
GET
/tunnels
List all tunnel sessions
POST
/edges/https
Create an HTTPS edge
GET
/endpoints
List all endpoints
POST
/reserved_domains
Reserve a custom domain
POST
/ip_policies
Create an IP restriction policy
POST
/event_subscriptions
Subscribe to webhook events
POST
/tunnels
Create a tunnel session
GET
/tunnels
List all tunnel sessions
POST
/edges/https
Create an HTTPS edge
GET
/endpoints
List all endpoints
POST
/reserved_domains
Reserve a custom domain
POST
/ip_policies
Create an IP restriction policy
POST
/event_subscriptions
Subscribe to webhook events
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring the ngrok API by hand means adding your bearer API key to every request to api.ngrok.com and building tunnel, edge, endpoint, reserved-domain, and IP-policy calls across a large surface yourself. Through Jentic you install once, import the ngrok API from the API Directory, store the API key once, and your agent calls it.
Permission scoping
The tunnel and endpoint operations shown here are collection actions like POST /tunnels that carry their configuration in the request body rather than a resource id in the path, so scope your agent to the operations it needs, such as creating and listing tunnels, while leaving edge, reserved-domain, or IP-policy changes out of the allowed set unless you add them.
Credential isolation
Your ngrok API key is stored once, encrypted, by your own Jentic One instance and added as the bearer token at execution time. It never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'expose a local server' and Jentic returns the matching ngrok operation with its input schema so the agent calls the right endpoint without browsing the reference docs.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using ngrok OpenAPI API through Jentic.
What authentication does the ngrok API use?
The ngrok API uses Bearer token authentication. You include your API key in the Authorization header as 'Bearer YOUR_API_KEY'. Jentic stores ngrok API keys encrypted in the credential vault and provides scoped access tokens to agents, so raw keys never appear in agent context. Get started with Jentic One, the self-hosted execution layer.
Can I create tunnels programmatically with the ngrok API?
Yes. Use the POST /tunnels endpoint to create tunnel sessions that expose local services to the internet. You can specify the protocol (HTTP, TCP, TLS), bind address, and metadata. The API returns the public URL and tunnel ID. Through Jentic, agents search for 'create a tunnel', load the schema, and execute the request without manual API documentation lookup.
What are the rate limits for the ngrok API?
The OpenAPI spec does not specify rate limits. Consult the ngrok documentation at https://ngrok.com/docs/api for current rate limit details by plan tier. Enterprise plans typically have higher limits.
How do I configure custom domains with the ngrok API?
Use the POST /reserved_domains endpoint to reserve a domain, then create an HTTPS edge (POST /edges/https) and associate it with the reserved domain. You can configure TLS certificates, authentication modules, and traffic policies on the edge. The API supports wildcard domains for multi-tenant routing.
Can I enforce IP restrictions on ngrok endpoints through the API?
Yes. Create an IP policy (POST /ip_policies) with allowed or denied CIDR ranges, then apply it to an HTTPS edge using the IP restriction module (POST /edges/https/{id}/routes/{route_id}/ip_restriction). The policy takes effect immediately on incoming traffic.
What webhook events does the ngrok API support?
You can subscribe to events like tunnel.created, tunnel.closed, endpoint.created, and endpoint.deleted via the POST /event_subscriptions endpoint. Specify a destination URL and the event sources you want to monitor. ngrok sends webhook payloads to your endpoint in real time. Use this for alerting, logging, or triggering automation.
How do AI agents use the ngrok API through Jentic?
Agents search Jentic for intents like 'expose a local server' or 'create a secure tunnel'. Jentic returns the relevant ngrok API operations (e.g., POST /tunnels) with their input schemas. The agent calls the operation via Jentic's execution layer, which handles authentication and request formatting. Integration time drops from days to minutes. Get started with Jentic One, the self-hosted execution layer.
Can I limit what my agent is allowed to do with the ngrok API?
Yes. Because you run Jentic One yourself, your own rules decide which ngrok operations and credentials the agent may use, so you can allow just the calls it needs, such as creating tunnels with POST /tunnels and listing them with GET /tunnels. These tunnel operations carry their configuration in the request body rather than a resource id in the path, so leaving edge (POST /edges/https), reserved-domain (POST /reserved_domains), and IP-policy (POST /ip_policies) actions out of the allowed set keeps the agent from making those changes unless you add them. Your stored ngrok API key is attached at execution time and never enters the agent's prompt or context.
GET STARTED