Security Macros

Early Access

This feature is currently in Early Access. Log into the ngrok dashboard to request access.

Security Macros allow you to access sensitive information directly in your Traffic Policies. Your ngrok account has a Vault that can store Secrets. Any secrets that you add to your vault will be available across your account on all traffic policies. Updates to these secrets will be reflected across all traffic policies automatically.

How secrets are secured

• Secrets are protected at rest using industry standard AES-256 encryption
• ngrok's REST API does not return secrets as part of any of its response payloads
• REST API traffic is encrypted in-transit using HTTP/S and TLS 1.2+

Get started

This section will walk you through creating a vault and secret. This example uses the ngrok CLI's api command, but you can also use the REST API directly. .

Loading…

You should get a response similar to the following:

Loading…

Then, create your secret, using the id from the response as the --vault-id:

Loading…

Then, you could use the secret in a Traffic Policy like this:

Loading…

Using secrets in you Kubernetes deployment

Vaults and secrets can be used in traffic policies in conjunction with Kubernetes Operator. Vaults and Secrets must be created using the ngrok API (either through REST or via the CLI).

You can use your secrets with your Kubernetes deployment via Traffic Policy. See the Kubernetes Operator quickstart to learn more.

Macros

secret(string, string) -> string

Takes the vault name as the first argument and the secret name as the second argument. Returns the secret value.

Example

Loading…

Supported Traffic Policy Actions

• set-vars
  • is supported in the following fields:
    • vars
• verify-webhook
  • CEL is supported in the following fields:
    • secret
• basic-auth
  • CEL is supported in the following fields:
    • credentials
• jwt-validation
  • CEL is supported in the following fields:
    • issuer.allow_list[*].value
    • http.tokens[*].name
    • http.tokens[*].prefix
    • jws.keys[*].sources[*].additional_jkus

Pricing and limits

Plan	Vault Limit	Secret Limit (across all vaults)	Notes
Free	5	5	All values are fixed. If you need more vaults/secrets, move to Personal or Paygo.
Pro	5	25	All values are fixed. If you need more vaults/secrets, move to Paygo.
Business	5 (default limit)	500 (default limit)	Contact us if you need more vaults/secrets than default limits.

If you want to increase these limits, contact us.