--- title: Implement mutual TLS (mTLS) at an API gateway | daily.dev description: A tutorial explains how to implement mutual TLS (mTLS) at an API gateway using ngrok's Traffic Policy engine. It covers TLS fundamentals (public/private keys,... canonical: https://daily.dev/posts/implement-mutual-tls-mtls-at-an-api-gateway-schxeyirf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Implement mutual TLS (mTLS) at an API gateway | daily.dev og:description: A tutorial explains how to implement mutual TLS (mTLS) at an API gateway using ngrok's Traffic Policy engine. It covers TLS fundamentals (public/private keys,... og:url: https://daily.dev/posts/implement-mutual-tls-mtls-at-an-api-gateway-schxeyirf og:image: https://api.daily.dev/og/posts/sCHXEYIrf.png og:image:alt: Implement mutual TLS (mTLS) at an API gateway og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Implement mutual TLS (mTLS) at an API gateway **[ngrok Blog](https://daily.dev/sources/ngrok)** · 8 min read · 0 upvotes · 0 comments ## Summary A tutorial explains how to implement mutual TLS (mTLS) at an API gateway using ngrok's Traffic Policy engine. It covers TLS fundamentals (public/private keys, certificate authorities, TLS certificates), why mTLS is useful for zero-trust API security, and walks through generating certificates with OpenSSL and configuring a Traffic Policy YAML file that works identically across ngrok's Agent Endpoints (development) and Cloud Endpoints (production). It also touches on scaling with Endpoint Pools for load balancing mTLS-secured APIs. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the difference between TLS and mutual TLS (mTLS) for an API? Standard TLS only requires the client to verify the server's certificate, protecting the consumer but leaving the server unable to verify who is calling it. Mutual TLS adds a second verification step where the server also requests and validates the client's certificate against a certificate authority, so both sides authenticate each other before exchanging data. _Teams weighing mTLS against standard TLS can track API security patterns like this on daily.dev._ ### How do I configure mTLS on an ngrok API gateway? Configure it through ngrok's Traffic Policy engine using a single YAML file that references your CA certificate; the same file works identically on both Agent Endpoints (CLI-based, for development) and Cloud Endpoints (persistent, for production). Requests missing a valid client certificate are rejected with a TLS error before ever reaching the endpoint. _Developers setting up certificate-based API auth can follow gateway configuration guides like this on daily.dev._ ### What are ngrok Cloud Endpoints versus Agent Endpoints? Agent Endpoints are created by the ngrok CLI, SDKs, or Kubernetes Operator and only stay alive as long as the agent process runs, making them suited for development and testing. Cloud Endpoints are persistent, always-on endpoints managed from the ngrok dashboard or API, recommended for production API gateways since they remain up independent of any single agent process. _Anyone choosing between dev-only and production gateway setups can compare options like this on daily.dev._ ## Similar posts on daily.dev - [Mutual TLS \(mTLS\) Authentication A Complete Guide](https://daily.dev/posts/mutual-tls-mtls-authentication-a-complete-guide-s8a9whgm7) · GitGuardian · 0 upvotes · 0 comments - [Enhance Integration Security with mTLS for Salesforce and MuleSoft](https://daily.dev/posts/enhance-integration-security-with-mtls-for-salesforce-and-mulesoft-nu5b21eb4) · Salesforce Developers Blog · 0 upvotes · 0 comments - [A visual guide to Public Key Infrastructure \(PKI\) Part 2 — When the Server Needs to Trust the Client](https://daily.dev/posts/a-visual-guide-to-public-key-infrastructure-pki-part-2-when-the-server-needs-to-trust-the-client-u3icrtiag) · Towards Dev · 0 upvotes · 0 comments - [Tutorial: Add TLS to Nginx Gateway Fabric](https://daily.dev/posts/tutorial-add-tls-to-nginx-gateway-fabric-6f7dln7uy) · The New Stack · 1 upvotes · 0 comments - [The 2026 Guide to Managing Wildcard TLS with Kubernetes Gateway API](https://daily.dev/posts/the-2026-guide-to-managing-wildcard-tls-with-kubernetes-gateway-api-b9t2bgsrw) · ITNEXT · 0 upvotes · 0 comments --- Tags: [#devtools](https://daily.dev/tags/devtools), [#authentication](https://daily.dev/tags/authentication), [#api-gateway](https://daily.dev/tags/api-gateway) [View this post on daily.dev](https://daily.dev/posts/implement-mutual-tls-mtls-at-an-api-gateway-schxeyirf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Implement mutual TLS (mTLS) at an API gateway","url":"https://daily.dev/posts/implement-mutual-tls-mtls-at-an-api-gateway-schxeyirf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/implement-mutual-tls-mtls-at-an-api-gateway-schxeyirf"},"datePublished":"2026-08-23T07:21:37.732Z","dateModified":"2026-08-23T07:27:31.880Z","description":"A tutorial explains how to implement mutual TLS (mTLS) at an API gateway using ngrok's Traffic Policy engine. It covers TLS fundamentals (public/private keys,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/888064c31c6113e38347e04e02055860?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/888064c31c6113e38347e04e02055860?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/implement-mutual-tls-mtls-at-an-api-gateway-schxeyirf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"devtools,authentication,api-gateway","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"Implement mutual TLS (mTLS) at an API gateway"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/implement-mutual-tls-mtls-at-an-api-gateway-schxeyirf#faq","mainEntity":[{"@type":"Question","name":"What is the difference between TLS and mutual TLS (mTLS) for an API?","acceptedAnswer":{"@type":"Answer","text":"Standard TLS only requires the client to verify the server's certificate, protecting the consumer but leaving the server unable to verify who is calling it. Mutual TLS adds a second verification step where the server also requests and validates the client's certificate against a certificate authority, so both sides authenticate each other before exchanging data. Teams weighing mTLS against standard TLS can track API security patterns like this on daily.dev."}},{"@type":"Question","name":"How do I configure mTLS on an ngrok API gateway?","acceptedAnswer":{"@type":"Answer","text":"Configure it through ngrok's Traffic Policy engine using a single YAML file that references your CA certificate; the same file works identically on both Agent Endpoints (CLI-based, for development) and Cloud Endpoints (persistent, for production). Requests missing a valid client certificate are rejected with a TLS error before ever reaching the endpoint. Developers setting up certificate-based API auth can follow gateway configuration guides like this on daily.dev."}},{"@type":"Question","name":"What are ngrok Cloud Endpoints versus Agent Endpoints?","acceptedAnswer":{"@type":"Answer","text":"Agent Endpoints are created by the ngrok CLI, SDKs, or Kubernetes Operator and only stay alive as long as the agent process runs, making them suited for development and testing. Cloud Endpoints are persistent, always-on endpoints managed from the ngrok dashboard or API, recommended for production API gateways since they remain up independent of any single agent process. Anyone choosing between dev-only and production gateway setups can compare options like this on daily.dev."}}]} ```