--- title: There and Back Again: An OAuth Story | daily.dev description: A former Okta OAuth specialist recounts being surprised by how easily ngrok can add OAuth 2.0 protection in front of any application without code changes. The... canonical: https://daily.dev/posts/there-and-back-again-an-oauth-story-qfbqw8qpx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: There and Back Again: An OAuth Story | daily.dev og:description: A former Okta OAuth specialist recounts being surprised by how easily ngrok can add OAuth 2.0 protection in front of any application without code changes. The... og:url: https://daily.dev/posts/there-and-back-again-an-oauth-story-qfbqw8qpx og:image: https://api.daily.dev/og/posts/qFBQW8Qpx.png og:image:alt: There and Back Again: An OAuth Story og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # There and Back Again: An OAuth Story **[ngrok Blog](https://daily.dev/sources/ngrok)** · 4 min read · 0 upvotes · 0 comments ## Summary A former Okta OAuth specialist recounts being surprised by how easily ngrok can add OAuth 2.0 protection in front of any application without code changes. The piece walks through using ngrok's edge with public OAuth providers like Google, then shows how it injects user identity into request headers, and finally demonstrates configuring a custom OIDC provider (Okta) so the full access token is passed through as a header for deeper integration. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does ngrok pass OAuth user info to my application when using a public provider like Google? ngrok injects selected fields from the OAuth provider into request headers, such as ngrok-auth-user-email, so the application can read the authenticated user's email without implementing OAuth itself. The ngrok edge acts as a policy enforcement point, verifying an access token before traffic reaches the application, so the app never processes unauthenticated requests. _Developers wiring up ngrok-based OAuth edges can track tunneling and auth workflow tips on daily.dev._ ### Can ngrok enforce OAuth using a custom or private identity provider instead of just Google or GitHub? Yes, ngrok supports custom OIDC providers by setting the oidc, oidc-client-id, and oidc-client-secret options, for example pointing to an Okta authorization server. Unlike public providers where only select fields are passed, a custom OIDC setup passes the entire access token via a header called ngrok-auth-oauth-access-token, giving the application every field from the authorization server. _Teams evaluating OAuth providers for internal apps can compare setups like this on daily.dev._ ## Similar posts on daily.dev - [How OAuth works: GitHub and Google login explained](https://daily.dev/posts/how-oauth-works-github-and-google-login-explained-z7bhexnib) · Flavio Copes · 1 upvotes · 0 comments - [How OAuth 2.0 Works: A Practical Guide for Backend Developers](https://daily.dev/posts/how-oauth-2-0-works-a-practical-guide-for-backend-developers-y3b2rqzzv) · freeCodeCamp · 40 upvotes · 3 comments - [An Introduction to OAuth 2](https://daily.dev/posts/an-introduction-to-oauth-2-4iox2hqnk) · DigitalOcean Community · 0 upvotes · 0 comments - [How to Secure APIs with OAuth 2.1 and OpenID Connect](https://daily.dev/posts/how-to-secure-apis-with-oauth-2-1-and-openid-connect-rf7g6orkv) · C\# Corner · 0 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#devtools](https://daily.dev/tags/devtools), [#authentication](https://daily.dev/tags/authentication), [#oauth](https://daily.dev/tags/oauth), [#okta](https://daily.dev/tags/okta) [View this post on daily.dev](https://daily.dev/posts/there-and-back-again-an-oauth-story-qfbqw8qpx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"There and Back Again: An OAuth Story","url":"https://daily.dev/posts/there-and-back-again-an-oauth-story-qfbqw8qpx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/there-and-back-again-an-oauth-story-qfbqw8qpx"},"datePublished":"2026-08-23T07:21:41.876Z","dateModified":"2026-08-23T07:28:39.698Z","description":"A former Okta OAuth specialist recounts being surprised by how easily ngrok can add OAuth 2.0 protection in front of any application without code changes. The...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/14605e4e79b9b8a30ba20a02829eae45?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/14605e4e79b9b8a30ba20a02829eae45?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/there-and-back-again-an-oauth-story-qfbqw8qpx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,devtools,authentication,oauth,okta","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"There and Back Again: An OAuth Story"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/there-and-back-again-an-oauth-story-qfbqw8qpx#faq","mainEntity":[{"@type":"Question","name":"How does ngrok pass OAuth user info to my application when using a public provider like Google?","acceptedAnswer":{"@type":"Answer","text":"ngrok injects selected fields from the OAuth provider into request headers, such as ngrok-auth-user-email, so the application can read the authenticated user's email without implementing OAuth itself. The ngrok edge acts as a policy enforcement point, verifying an access token before traffic reaches the application, so the app never processes unauthenticated requests. Developers wiring up ngrok-based OAuth edges can track tunneling and auth workflow tips on daily.dev."}},{"@type":"Question","name":"Can ngrok enforce OAuth using a custom or private identity provider instead of just Google or GitHub?","acceptedAnswer":{"@type":"Answer","text":"Yes, ngrok supports custom OIDC providers by setting the oidc, oidc-client-id, and oidc-client-secret options, for example pointing to an Okta authorization server. Unlike public providers where only select fields are passed, a custom OIDC setup passes the entire access token via a header called ngrok-auth-oauth-access-token, giving the application every field from the authorization server. Teams evaluating OAuth providers for internal apps can compare setups like this on daily.dev."}}]} ```