Support
Ngris offers identity-aware access at two levels: per-endpoint OAuth for the people who use your tunnels, and account-wide SSO for the people who sign in to your Ngris dashboard.
Per-endpoint OAuth providers
Configure delegated authentication for an endpoint under Endpoint Settings → OAuth Providers. Supported providers are Google, GitHub, Azure AD, Okta, Auth0, and a Custom OIDC-compatible provider. One provider type is enforced per endpoint, and each can be enabled or disabled independently. The dashboard shows the redirect/callback URL to register with your provider.
Registration policy
Control how new users get endpoint access via one of three modes: Open (anyone can register), Invite Only (only users with a valid invite link), or Requires Approval (users register but an admin must approve). Additional settings include email domain allow/block lists, email verification, password complexity, and a default role for new registrations.
Account SSO (dashboard login)
Account owners and admins configure SSO under Account Settings → SSO (/account/settings/sso). SSO is account-scoped, gated by the SSO plan entitlement, and keyed by email domain — members whose email matches a verified, configured domain sign in through that provider. The provider_type is one of google, github, or oidc. When a configuration is marked enforced, matching-domain users must sign in via SSO instead of a password.
Custom OIDC providers (Okta, Microsoft Entra ID, Auth0, or any OIDC-compliant identity provider) are fully supported. Paste your provider's issuer URL and click Discover to auto-fill the authorization, token, and userinfo endpoints along with the issuer and JWKS URL. At login, Ngris cryptographically verifies the provider's signed id_token — its signature against the published JWKS, plus the issuer, audience, expiry, and login nonce — before establishing a session, so an identity is trusted only when your IdP provably asserts it. Google and GitHub use Ngris's own fixed endpoints and need no issuer or JWKS URL.