ngrok setup

ConfigView reads your ngrok account through the ngrok API, using one API key that an ngrok admin creates in the ngrok dashboard. It shows what your account exposes to the internet right now, which machines are running the agent, and who owns the authtokens, API keys and service users behind it. You will end up with 1 required secret (NGROK_API_KEY) in ConfigView when setup is complete.

Scope of this integration today. ConfigView collects endpoints and tunnels (public URL, what each forwards to, and which Traffic Policy protections it has), connected agent sessions (source IP, operating system, agent version), authtokens, SSH credentials, API keys, service users, reserved domains and TCP addresses, IP policies, rules and restrictions, uploaded TLS certificates, and the people who signed in to your protected endpoints. It never reads authtokens, API key values, Traffic Policy text or certificate contents. ConfigView only reads. It never creates, changes or deletes anything in ngrok.

What you need

An ngrok account where you can create an API key (any account member can create one; use an admin or a service user)
Nothing else to enable. A few areas depend on your ngrok plan: IP restrictions, uploaded TLS certificates and endpoint sign-in records. If an area is not available, that collector skips itself and its table stays empty. That does not count as a failure.

Step 1: Open the ngrok page in ConfigView

Open ConfigView in a second browser tab and leave it open: https://{companyname}.configview.com/admin/integrations/ngrok

Step 2: Create an API key

ngrok API keys are not scoped: a key can do whatever the account member or service user that owns it can do. ngrok has no read-only API key, so protect this one in two ways:

Create a dedicated service user for it. In the ngrok dashboard open Service Users, click New Service User, and name it configview. A service user is a machine identity that is not tied to a person, so the key keeps working when staff leave.
Optionally add an IP restriction of type API in the dashboard (IP Restrictions) so only ConfigView’s address can call the API.

Then create the key:

Open API Keys in the dashboard (dashboard.ngrok.com/api-keys) and click New API Key
Set the description to ConfigView. If you created a service user, set it as the owner
Copy the key now. ngrok shows it only once
Switch to the ConfigView tab and paste it into NGROK_API_KEY under Credentials, then click the save icon

This must be an API key, not an authtoken. Authtokens start the ngrok agent; they cannot call the API.

Step 3: Connect and verify

Back on https://{companyname}.configview.com/admin/integrations/ngrok, confirm the credential shows as saved
Click Connect. ConfigView creates its tables and schedules every collector at your default run time. Stop any you don’t want under Collectors:

Script	Notes
Endpoints	Every endpoint online now: public URL, protocol, whether it is public, what it forwards to, its owner and agent session, and which Traffic Policy protections it has. The policy text is never stored.
Tunnels	Agent tunnels online now, with the local address each forwards to.
Agent Sessions	Connected agents: source IP, operating system, agent version, region and the credential they signed in with.
Authtokens	Tunnel credentials: description, owner, creation date and ACL. The token is never stored.
SSH Credentials	SSH credentials allowed to start tunnels.
API Keys	API keys with description, owner and creation date. Key values are never stored.
Service Users	Machine identities, whether each is active, and when it was created.
Reserved Domains	Reserved domains, custom or ngrok, with certificate status.
Reserved TCP Addresses	Reserved host:port addresses.
IP Policies, IP Policy Rules, IP Restrictions	IP allow and deny lists, their rules, and where each restriction is enforced.
TLS Certificates	Uploaded TLS certificates with names and validity dates.
Endpoint Sign-ins	People who signed in to endpoints protected by OAuth, OpenID Connect or SAML.

Click Verify now. The health check reads the secret, calls the ngrok API, and tries one record from each area.

If a check fails:

The API check fails with 401. The key was rejected: it was revoked, mistyped, or it is an authtoken rather than an API key. Create a new API key and paste it again.
It fails with 403. The key’s owner cannot read that area, or an API IP restriction is blocking ConfigView’s address. Allow the address or use a key owned by a member with access.
It fails with 429. ngrok allows 120 requests a minute for the whole account. Wait a minute and verify again.
An area shows as skipped. ngrok answered “forbidden” or “not found” for it, usually because your plan does not include the feature. There is nothing to fix.

Data Tables

Once the scripts run, these tables are created in your database. Each table has a run_at column and a raw_json column, which holds the record as ngrok returned it, minus anything listed under What isn’t collected. Each table keeps only the newest run.

Table	Source	Key Columns
`ngrok_endpoints`	`GET /endpoints`	endpoint_id, url, proto, endpoint_type, is_public, upstream_url, tunnel_session_id, principal_id, policy_actions, has_auth_action, has_ip_restriction, protection_visible
`ngrok_tunnels`	`GET /tunnels`	tunnel_id, public_url, proto, forwards_to, tunnel_session_id
`ngrok_tunnel_sessions`	`GET /tunnel_sessions`	session_id, source_ip, host_os, agent_version, region, started_at, credential_id
`ngrok_credentials`	`GET /credentials`	credential_id, description, owner_id, owner_type, acl, has_acl, created_at
`ngrok_ssh_credentials`	`GET /ssh_credentials`	credential_id, description, owner_id, acl, created_at
`ngrok_api_keys`	`GET /api_keys`	key_id, description, owner_id, owner_type, created_at
`ngrok_service_users`	`GET /service_users`	service_user_id, name, is_active, created_at
`ngrok_reserved_domains`	`GET /reserved_domains`	domain_id, domain, is_custom_domain, cname_target, cert_renews_at, cert_error_code
`ngrok_reserved_addrs`	`GET /reserved_addrs`	addr_id, addr, region, description
`ngrok_ip_policies`	`GET /ip_policies`	ip_policy_id, description
`ngrok_ip_policy_rules`	`GET /ip_policy_rules`	rule_id, ip_policy_id, cidr, rule_action, is_open_to_internet
`ngrok_ip_restrictions`	`GET /ip_restrictions`	restriction_id, restriction_type, is_enforced, ip_policy_ids
`ngrok_tls_certificates`	`GET /tls_certificates`	certificate_id, subject_common_name, dns_names, not_before, not_after
`ngrok_app_users`	`GET /app/users`	app_user_id, email, name, provider_name, last_login

Things worth knowing

Endpoints, tunnels and agent sessions are a snapshot of what is online. ngrok lists only what is connected when ConfigView collects. An endpoint that was up yesterday and is down now is not in the table, and ngrok keeps no session history in the API. ConfigView shows protection from Traffic Policy only. For each endpoint it records the names of the Traffic Policy actions (for example oauth, basic-auth, jwt-validation, restrict-ips) and whether mutual TLS is set. Endpoints of type edge are configured through the older edge modules, which this list does not show, so they are marked protection_visible = 0 and are never reported as unprotected. An account-wide IP restriction of type endpoints also protects everything; check ngrok_ip_restrictions. Owners are ids, not names. An API key, authtoken or endpoint is owned by usr_... (a person) or bot_... (a service user). ConfigView can show a service user’s name, but ngrok does not let the API list your human team members, so a person appears only as an id. Review the team on the ngrok dashboard. ngrok does not report last use. Neither authtokens nor API keys carry a last-used date. ConfigView can tell whether an agent is connected with an authtoken right now, and that is all. Endpoint sign-ins are your visitors. ngrok_app_users lists people who signed in to your protected endpoints, not members of your ngrok account. Rate limit. ngrok allows 120 requests per rolling 60 seconds per account (some plans more). Each ConfigView collector makes about one request per 100 records and paces itself at 30 a minute, waiting and retrying on a 429.

What isn’t collected

Authtokens, API key values and SSH public keys
Traffic Policy text (it can hold basic-auth passwords and OAuth client secrets): only the action names and yes/no facts are kept
TLS certificate and key material
User names and passwords inside URLs (cut off before storing)
Edges and their routes, application sessions, event destinations, vaults and secrets, abuse reports, and ngrok AI Gateway keys

Platform

Integrations

What you need

Step 1: Open the ngrok page in ConfigView

Step 2: Create an API key

Step 3: Connect and verify

Data Tables

Things worth knowing

What isn’t collected

​What you need

​Step 1: Open the ngrok page in ConfigView

​Step 2: Create an API key

​Step 3: Connect and verify

​Data Tables

​Things worth knowing

​What isn’t collected

What you need

Step 1: Open the ngrok page in ConfigView

Step 2: Create an API key

Step 3: Connect and verify

Data Tables

Things worth knowing

What isn’t collected