cloudparts

ngrok

A small agent dials out from your laptop, server or cluster to ngrok’s network, which gives the service a public URL and carries its traffic back down that connection.

What it is
Remote access
Used for
API gateways
Type
Commercial product
Made by
ngrok, Inc.
License
Proprietary (the archived 1.x agent was Apache 2.0)
Facts checked
13 October 2026
Website

What it is

You run an agent next to the service: the ngrok command, an Agent SDK inside your app, the Kubernetes Operator, or plain ssh -R. It opens one long-lived, outbound TLS connection to ngrok on port 443, called a session, and asks ngrok to create endpoints on it. ngrok http 8080 returns a public HTTPS URL with a certificate ngrok provisions. Requests land at one of ngrok’s eight points of presence (Ohio, California, São Paulo, Frankfurt, Mumbai, Singapore, Tokyo and Sydney) and travel back down the session to localhost:8080. ngrok tcp and ngrok tls carry databases, SSH and RDP the same way. Nothing listens on your machine, so it works behind NAT and firewalls that block inbound traffic.

An agent endpoint lives only as long as its session: stop the agent and the URL stops answering. Cloud Endpoints are configured centrally and stay up with no process of yours running, and two endpoints with the same URL form a pool that shares traffic. Authentication, IP rules, rewrites and rate limits are written as a Traffic Policy, which ngrok applies in its own network before traffic reaches the agent, so the same rules work whichever kind of agent created the endpoint. ngrok now sells this as Gateway, next to an AI Gateway for model providers, with Share Localhost, the original use, as the third product.

Why teams pick it

  • No inbound port, public IP or firewall change: one outbound TLS connection on port 443 works from home Wi-Fi and locked-down corporate networks, and the session lets you restart or upgrade an agent from the dashboard or API
  • Built for webhooks and demos: ngrok http 8080 gives an HTTPS URL at once, and the inspector at localhost:4040 shows every request’s headers and body and can replay it
  • One model from laptop to production: the CLI, Agent SDKs for Python, JavaScript, Go, Rust and Java, and a Kubernetes Operator that turns Ingress and Gateway API resources into endpoints
  • Traffic Policy moves auth, IP restrictions and rate limiting out of the app, and nobody can go around ngrok to the origin because it has no public address

Watch out for

  • The free plan allows 1 GB of transfer, 20,000 HTTP requests and 5,000 TCP connections a month, up to 3 online endpoints on one assigned dev domain, and shows an interstitial warning page to browser visitors
  • Agent endpoints go offline when the agent does; staying up takes a service install, a reserved domain, a pool of agents or a Cloud Endpoint
  • Paid use is metered: Pay-as-you-go is $20 a month with $20 of usage included, then $0.10 per GB out, $1 per 100,000 HTTP requests, endpoint hours and Traffic Policy units; on the $10 Hobbyist plan endpoints stop when the credit runs out
  • Every request hairpins through a third party’s eight regions, and ngrok terminates TLS for HTTPS endpoints unless you set up TLS termination at the agent; the local inspector only covers HTTP

Alternatives

What all remote access have in common →Compare side by side →
Cloudflare TunnelCommercialA small daemon, cloudflared, dials out from your network to Cloudflare, so servers can be published or reached privately with no public IP and no open inbound ports.

How it fits with other technologies

Expose local services with the ngrok agent · bash

# a web app on a random public HTTPS URL
ngrok http 8080

# a reserved URL that survives restarts, with basic auth from a Traffic Policy file
ngrok http 8080 --url https://example.ngrok.app --traffic-policy-file traffic-policy.yml

# anything that isn't HTTP, such as SSH
ngrok tcp 22

See it in a real stack

No architecture uses ngrok yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2013–2026

Webhooks need a public address: a service such as Twilio calls your HTTP server when something happens, and a laptop has none. Alan Shreve described what testing one Twilio app took: a phone call that crossed the phone network into Twilio’s data center, which made an HTTP request to a tunnel and on to the local service, “a really, really expensive HTTP request.” Tunneling tools already existed, and localtunnel was widely used.

Shreve wrote ngrok in Go in 2013, mostly to learn the language: “I actually built it to learn Go… I guess the third priority was to make web development easier.” Version 1 was open source under Apache 2.0 and developed from 2013 to 2016, and its inspector let developers look at and replay a request instead of triggering the webhook again. Later versions became a closed, hosted service, and the v1 repository is now archived as no longer developed or supported.

The company grew without outside money. When it raised a $50 million Series A led by Lightspeed Venture Partners in December 2022, its first fundraise, it said more than 30,000 paying customers had funded it and more than 5 million developers used it. Since then ngrok has moved from tunnels toward a general ingress platform: Traffic Policy, Cloud Endpoints, endpoint pooling and an AI Gateway, with sharing localhost as one product of three.

Why it’s built this way

The agent dials out instead of ngrok forwarding to an IP
Services can then run anywhere (any cloud, an on-prem data center, a Raspberry Pi, a laptop) with no DNS, ports or certificates to set up, and attackers can’t go around ngrok by finding the upstream address.
Write it in Go
Shreve built it to learn Go, and later credited the project’s success “in no small part to choosing Go as the implementation language” and to feedback from the Go community.
Apply policy in ngrok’s network, not in the agent
The agent only connects and forwards. Keeping authentication, routing and rate limits in the cloud service means one policy behaves the same for the CLI, an SDK, the Kubernetes Operator or reverse SSH.

Timeline

  1. 2013

    Alan Shreve publishes ngrok 1.x on GitHub in March, open source under Apache 2.0

  2. 2016

    Twilio profiles ngrok, used by over 40,000 developers; active work on v1 ends

  3. 2022

    Raises a $50 million Series A, its first outside funding, on December 13

  4. 2026

    Docs describe three products: Gateway, AI Gateway and Share Localhost

Sources15 · facts checked 13 October 2026

Improve this page on GitHub