> ## Documentation Index > Fetch the complete documentation index at: https://support.configview.com/llms.txt > Use this file to discover all available pages before exploring further. # ngrok setup ConfigView reads your ngrok account through the ngrok API, using one **API key** that an ngrok admin creates in the ngrok dashboard. It shows what your account exposes to the internet right now, which machines are running the agent, and who owns the authtokens, API keys and service users behind it. You will end up with **1 required secret** (`NGROK_API_KEY`) in ConfigView when setup is complete. > **Scope of this integration today.** ConfigView collects endpoints and tunnels (public URL, what each forwards to, and which Traffic Policy protections it has), connected agent sessions (source IP, operating system, agent version), authtokens, SSH credentials, API keys, service users, reserved domains and TCP addresses, IP policies, rules and restrictions, uploaded TLS certificates, and the people who signed in to your protected endpoints. It never reads authtokens, API key values, Traffic Policy text or certificate contents. ConfigView only reads. It never creates, changes or deletes anything in ngrok. *** ## What you need * An ngrok account where you can create an API key (any account member can create one; use an admin or a service user) * Nothing else to enable. A few areas depend on your ngrok plan: IP restrictions, uploaded TLS certificates and endpoint sign-in records. If an area is not available, that collector skips itself and its table stays empty. That does not count as a failure. *** ## Step 1: Open the ngrok page in ConfigView Open ConfigView in a second browser tab and leave it open: `https://{companyname}.configview.com/admin/integrations/ngrok` *** ## Step 2: Create an API key ngrok API keys are **not scoped**: a key can do whatever the account member or service user that owns it can do. ngrok has no read-only API key, so protect this one in two ways: 1. **Create a dedicated service user** for it. In the ngrok dashboard open **Service Users**, click **New Service User**, and name it `configview`. A service user is a machine identity that is not tied to a person, so the key keeps working when staff leave. 2. Optionally add an **IP restriction of type API** in the dashboard (**IP Restrictions**) so only ConfigView's address can call the API. Then create the key: 1. Open **API Keys** in the dashboard (`dashboard.ngrok.com/api-keys`) and click **New API Key** 2. Set the description to `ConfigView`. If you created a service user, set it as the owner 3. Copy the key now. ngrok shows it **only once** 4. Switch to the ConfigView tab and paste it into `NGROK_API_KEY` under **Credentials**, then click the save icon This must be an **API key**, not an authtoken. Authtokens start the ngrok agent; they cannot call the API. *** ## Step 3: Connect and verify 1. Back on `https://{companyname}.configview.com/admin/integrations/ngrok`, confirm the credential shows as saved 2. Click **Connect**. ConfigView creates its tables and schedules every collector at your default run time. Stop any you don't want under **Collectors**: | Script | Notes | | - | - | | **Endpoints** | Every endpoint online now: public URL, protocol, whether it is public, what it forwards to, its owner and agent session, and which Traffic Policy protections it has. The policy text is never stored. | | **Tunnels** | Agent tunnels online now, with the local address each forwards to. | | **Agent Sessions** | Connected agents: source IP, operating system, agent version, region and the credential they signed in with. | | **Authtokens** | Tunnel credentials: description, owner, creation date and ACL. The token is never stored. | | **SSH Credentials** | SSH credentials allowed to start tunnels. | | **API Keys** | API keys with description, owner and creation date. Key values are never stored. | | **Service Users** | Machine identities, whether each is active, and when it was created. | | **Reserved Domains** | Reserved domains, custom or ngrok, with certificate status. | | **Reserved TCP Addresses** | Reserved host:port addresses. | | **IP Policies**, **IP Policy Rules**, **IP Restrictions** | IP allow and deny lists, their rules, and where each restriction is enforced. | | **TLS Certificates** | Uploaded TLS certificates with names and validity dates. | | **Endpoint Sign-ins** | People who signed in to endpoints protected by OAuth, OpenID Connect or SAML. | 3. Click **Verify now**. The health check reads the secret, calls the ngrok API, and tries one record from each area. If a check fails: * **The API check fails with 401.** The key was rejected: it was revoked, mistyped, or it is an authtoken rather than an API key. Create a new API key and paste it again. * **It fails with 403.** The key's owner cannot read that area, or an API IP restriction is blocking ConfigView's address. Allow the address or use a key owned by a member with access. * **It fails with 429.** ngrok allows 120 requests a minute for the whole account. Wait a minute and verify again. * **An area shows as skipped.** ngrok answered "forbidden" or "not found" for it, usually because your plan does not include the feature. There is nothing to fix. *** ## Data Tables Once the scripts run, these tables are created in your database. Each table has a `run_at` column and a `raw_json` column, which holds the record as ngrok returned it, minus anything listed under *What isn't collected*. Each table keeps only the newest run. | Table | Source | Key Columns | | - | - | - | | `ngrok_endpoints` | `GET /endpoints` | endpoint\_id, url, proto, endpoint\_type, is\_public, upstream\_url, tunnel\_session\_id, principal\_id, policy\_actions, has\_auth\_action, has\_ip\_restriction, protection\_visible | | `ngrok_tunnels` | `GET /tunnels` | tunnel\_id, public\_url, proto, forwards\_to, tunnel\_session\_id | | `ngrok_tunnel_sessions` | `GET /tunnel_sessions` | session\_id, source\_ip, host\_os, agent\_version, region, started\_at, credential\_id | | `ngrok_credentials` | `GET /credentials` | credential\_id, description, owner\_id, owner\_type, acl, has\_acl, created\_at | | `ngrok_ssh_credentials` | `GET /ssh_credentials` | credential\_id, description, owner\_id, acl, created\_at | | `ngrok_api_keys` | `GET /api_keys` | key\_id, description, owner\_id, owner\_type, created\_at | | `ngrok_service_users` | `GET /service_users` | service\_user\_id, name, is\_active, created\_at | | `ngrok_reserved_domains` | `GET /reserved_domains` | domain\_id, domain, is\_custom\_domain, cname\_target, cert\_renews\_at, cert\_error\_code | | `ngrok_reserved_addrs` | `GET /reserved_addrs` | addr\_id, addr, region, description | | `ngrok_ip_policies` | `GET /ip_policies` | ip\_policy\_id, description | | `ngrok_ip_policy_rules` | `GET /ip_policy_rules` | rule\_id, ip\_policy\_id, cidr, rule\_action, is\_open\_to\_internet | | `ngrok_ip_restrictions` | `GET /ip_restrictions` | restriction\_id, restriction\_type, is\_enforced, ip\_policy\_ids | | `ngrok_tls_certificates` | `GET /tls_certificates` | certificate\_id, subject\_common\_name, dns\_names, not\_before, not\_after | | `ngrok_app_users` | `GET /app/users` | app\_user\_id, email, name, provider\_name, last\_login | *** ## Things worth knowing **Endpoints, tunnels and agent sessions are a snapshot of what is online.** ngrok lists only what is connected when ConfigView collects. An endpoint that was up yesterday and is down now is not in the table, and ngrok keeps no session history in the API. **ConfigView shows protection from Traffic Policy only.** For each endpoint it records the names of the Traffic Policy actions (for example `oauth`, `basic-auth`, `jwt-validation`, `restrict-ips`) and whether mutual TLS is set. Endpoints of type `edge` are configured through the older edge modules, which this list does not show, so they are marked `protection_visible = 0` and are never reported as unprotected. An account-wide IP restriction of type `endpoints` also protects everything; check `ngrok_ip_restrictions`. **Owners are ids, not names.** An API key, authtoken or endpoint is owned by `usr_...` (a person) or `bot_...` (a service user). ConfigView can show a service user's name, but ngrok does not let the API list your human team members, so a person appears only as an id. Review the team on the ngrok dashboard. **ngrok does not report last use.** Neither authtokens nor API keys carry a last-used date. ConfigView can tell whether an agent is connected with an authtoken right now, and that is all. **Endpoint sign-ins are your visitors.** `ngrok_app_users` lists people who signed in to your protected endpoints, not members of your ngrok account. **Rate limit.** ngrok allows 120 requests per rolling 60 seconds per account (some plans more). Each ConfigView collector makes about one request per 100 records and paces itself at 30 a minute, waiting and retrying on a 429. ## What isn't collected * Authtokens, API key values and SSH public keys * Traffic Policy text (it can hold basic-auth passwords and OAuth client secrets): only the action names and yes/no facts are kept * TLS certificate and key material * User names and passwords inside URLs (cut off before storing) * Edges and their routes, application sessions, event destinations, vaults and secrets, abuse reports, and ngrok AI Gateway keys This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.