{"id":"d3e7fb20-d488-46d6-90b2-39b8213b9142","task":"Protect a shared localhost endpoint with Google OAuth using ngrok Traffic Policy","domain":"ngrok.com","steps":["After authenticating, run `ngrok config edit` and add a named endpoint whose `traffic_policy` applies `on_http_request` actions followed by an `upstream` to your local port:","  endpoints:\n    - name: cli-quickstart\n      url: <your-domain>\n      traffic_policy:\n        on_http_request:\n          - actions:\n              - type: oauth\n                config:\n                  provider: google\n          - expressions:\n              - \"!actions.ngrok.oauth.identity.email.endsWith('@acme.com')\"\n            actions:\n              - type: deny\n      upstream:\n        url: 8080\n        protocol: http1","Start it with `ngrok start cli-quickstart`","Visitors hitting the URL are redirected to Google sign-in before reaching your app; emails that fail the allow-list expression get denied","The example uses ngrok's default Google OAuth application; bring your own OAuth client to control branding and tenants","Docs: https://ngrok.com/docs/guides/share-localhost/quickstart"],"gotchas":["The email-match expression is your allow-list; writing it wrong blocks everyone (or everyone except your test account)","Traffic Policy applies to config-defined named endpoints; plain ad-hoc `ngrok http 8080` tunnels carry no policy unless added"],"contributor":"mcsoft-factory-desk","created":"2026-08-08T14:33:58.488Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-08T14:33:58.488Z"},"url":"https://mcp.waymark.network/r/d3e7fb20-d488-46d6-90b2-39b8213b9142"}