--- title: Introducing JWT validation for your API | daily.dev description: ngrok's developer-defined API gateway now supports JWT validation, letting teams offload authentication and authorization checks to ngrok's global network... canonical: https://daily.dev/posts/introducing-jwt-validation-for-your-api-ahihcbpc9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Introducing JWT validation for your API | daily.dev og:description: ngrok's developer-defined API gateway now supports JWT validation, letting teams offload authentication and authorization checks to ngrok's global network... og:url: https://daily.dev/posts/introducing-jwt-validation-for-your-api-ahihcbpc9 og:image: https://api.daily.dev/og/posts/AhIhCBpc9.png og:image:alt: Introducing JWT validation for your API og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Introducing JWT validation for your API **[ngrok Blog](https://daily.dev/sources/ngrok)** · 4 min read · 0 upvotes · 0 comments ## Summary ngrok's developer-defined API gateway now supports JWT validation, letting teams offload authentication and authorization checks to ngrok's global network before requests reach their origin service. The feature validates tokens against a JSON Web Key Set (JWKS), checking presence, issuer trust, audience, expiration, and signature before forwarding traffic. It can be configured via Traffic Policy modules, agent config files, or the ngrok Dashboard, and supports validating tokens in the JWT body as well as headers. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does ngrok validate JWTs before requests reach my API? Ngrok's JWT Validation action checks tokens at its global network edge before forwarding traffic to the origin server. It confirms a JWT is present, verifies it was issued by a trusted source using the issuer's JWKS URL, checks the audience matches the origin service, confirms the token has not expired, and verifies the signature using configured algorithms and keys. _Teams offloading JWT checks to an API gateway can track ngrok updates like this on daily.dev._ ### Can I configure JWT validation for ngrok using a config file instead of the dashboard? Yes, JWT validation can be added to the Traffic Policy module configuration in the ngrok agent config file, and this configuration is pushed from the local agent to ngrok's global network so tokens are validated there before traffic reaches the origin. Alternatively, it can be configured directly for Edges in the ngrok Dashboard as an inbound policy. _Developers deciding between agent config and dashboard setups follow tooling changes like this on daily.dev._ ## Similar posts on daily.dev - [How To Use JSON Web Tokens \(JWTs\) in Express.js](https://daily.dev/posts/how-to-use-json-web-tokens-jwts-in-express-js-72ojkkino) · DigitalOcean Community · 7 upvotes · 0 comments - [JWT Authentication Without the Confusion](https://daily.dev/posts/jwt-authentication-without-the-confusion-tvh5u1id9) · Medium · 1 upvotes · 0 comments - [Application loadbalancer support client credential flow with JWT verification](https://daily.dev/posts/application-loadbalancer-support-client-credential-flow-with-jwt-verification-l3xdjzcfu) · AWS · 0 upvotes · 0 comments - [JWT Authentication in Node.js Explained Simply](https://daily.dev/posts/jwt-authentication-in-node-js-explained-simply-spsvcdwti) · Towards Dev · 5 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#devtools](https://daily.dev/tags/devtools), [#authentication](https://daily.dev/tags/authentication), [#api-gateway](https://daily.dev/tags/api-gateway), [#jwt](https://daily.dev/tags/jwt) [View this post on daily.dev](https://daily.dev/posts/introducing-jwt-validation-for-your-api-ahihcbpc9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Introducing JWT validation for your API","url":"https://daily.dev/posts/introducing-jwt-validation-for-your-api-ahihcbpc9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/introducing-jwt-validation-for-your-api-ahihcbpc9"},"datePublished":"2026-08-23T07:21:26.859Z","dateModified":"2026-08-23T07:28:50.669Z","description":"ngrok's developer-defined API gateway now supports JWT validation, letting teams offload authentication and authorization checks to ngrok's global network...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b8f24487999e61d59105678816feb4b3?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b8f24487999e61d59105678816feb4b3?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/introducing-jwt-validation-for-your-api-ahihcbpc9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,devtools,authentication,api-gateway,jwt","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"Introducing JWT validation for your API"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/introducing-jwt-validation-for-your-api-ahihcbpc9#faq","mainEntity":[{"@type":"Question","name":"How does ngrok validate JWTs before requests reach my API?","acceptedAnswer":{"@type":"Answer","text":"Ngrok's JWT Validation action checks tokens at its global network edge before forwarding traffic to the origin server. It confirms a JWT is present, verifies it was issued by a trusted source using the issuer's JWKS URL, checks the audience matches the origin service, confirms the token has not expired, and verifies the signature using configured algorithms and keys. Teams offloading JWT checks to an API gateway can track ngrok updates like this on daily.dev."}},{"@type":"Question","name":"Can I configure JWT validation for ngrok using a config file instead of the dashboard?","acceptedAnswer":{"@type":"Answer","text":"Yes, JWT validation can be added to the Traffic Policy module configuration in the ngrok agent config file, and this configuration is pushed from the local agent to ngrok's global network so tokens are validated there before traffic reaches the origin. Alternatively, it can be configured directly for Edges in the ngrok Dashboard as an inbound policy. Developers deciding between agent config and dashboard setups follow tooling changes like this on daily.dev."}}]} ```