oauth
Makes visitors sign in with Google or GitHub before they reach your service, and tells later rules who they are.
| Phases | on_http_request |
| Terminating | No — the next action runs after it. |
| Cost | Free |
Example
policy.yaml
on_http_request:
- actions:
- type: oauth
config:
provider: google
- expressions:
- "!actions.ngrok.oauth.identity.email.endsWith('@example.com')"
actions:
- type: deny
Start an agent endpoint with it: devgate http 8080 --traffic-policy-file policy.yaml, or paste it into a
reserved or cloud endpoint’s Traffic Policy tab in the dashboard.
Configuration
| Field | Type | Description |
|---|---|---|
provider required | string | google or github. |
client_id / client_secret | string | Your own OAuth app. Leave both out to use devgate’s. Your app’s redirect URI is https://idp.devgate.run/oauth2/callback. |
scopes | list of strings | Extra scopes to ask for; needs your own app. |
auth_id | string | Names the session, for several oauth actions or targeted login/logout. Default: the provider. |
max_session_duration | duration | How long a sign-in lasts, however active the visitor is. Default: 7d. |
idle_session_timeout | duration | Sign the visitor out after this long without a request. |
allow_cors_preflight | boolean | Let CORS preflight requests through without a session. Default: false. |
authz_url_params | map | Extra parameters for the provider’s authorization URL, e.g. hd for a Google Workspace domain. |
auth_cookie_domain | string | Share the session cookie across sub-domains of this domain. |
Result variables
After it runs, later rules can read what it decided:
-
actions.ngrok.oauth.identity.email— The visitor’s verified e-mail address. -
actions.ngrok.oauth.identity.name— Their name. -
actions.ngrok.oauth.identity.provider_user_id— Their id at the provider. -
actions.ngrok.oauth.identity.id— provider:id, stable per person and provider.
Behaviour
- Visitors without a session are redirected to the provider and come back where they started.
- The action only signs people in; deny or allow them in a later rule by e-mail or domain, as in the example.
- /ngrok/login and /ngrok/logout (or /devgate/login, /devgate/logout) start a sign-in and end the session.
- Sessions are signed cookies on your endpoint’s host; they never reach your service.
Other actions
add-headers remove-headers compress-response basic-auth openid-connect jwt-validation custom-response deny redirect url-rewrite restrict-ips rate-limit circuit-breaker verify-webhook http-request set-vars log close-connection forward-internal