# ngrok Alternatives With Authentication: 11 Ways to Control Who Gets In > ngrok alternatives that control who can open your local app: SSO, email codes, OAuth, basic auth, IP allowlists, and single-use links, compared. Source: https://layerv.ai/compare/ngrok-alternatives-with-auth/ --- [← All Comparisons](https://layerv.ai/compare/) # ngrok alternatives with authentication Eleven tools that decide who can open a shared app, by identity, password, network, or link. For email-based sign-in in front of a stable hostname, use Cloudflare Access on a named tunnel. For SSO and expiring share links on your own server, use Pangolin. For basic auth or an IP allowlist with no account, use Pinggy. For a link that opens once and expires within 24 hours, with no account, use qURL™. Facts checked October 1, 2026, each value linked to its source. [Full dataset](https://layerv.ai/compare/localhost-tunnels/). ## Why people look for ngrok alternatives - ngrok endpoints are public by default; access control is a Traffic Policy you add. - The free plan includes 3 OAuth or OIDC users a month. - An account and authtoken before the first URL. - Links have no built-in expiry, and the endpoint stays up while the agent runs. ## The alternatives at a glance __ngrok alternatives with authentication: what each is best for, and account needed before the first URL, visitor access control, link expiry, single-use links__ | Tool | Best for | Account needed before the first URL | Visitor access control | Link expiry | Single-use links | | ---------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [qURL CLI](https://layerv.ai/compare/ngrok-alternatives-with-auth/#alt-qurl) | A link that opens once and expires within 24 hours, with no account on either side | No. The first publish creates the device identity [our test](https://layerv.ai/research/qurl-behaviour) | Single-use access link by default; link and session lifetimes. IP allow and deny lists and other rules can gate links through the API, not the CLI [layerv.ai](https://layerv.ai/docs/qurls.md) | Yes. qurl share returned a 24-hour link in our no-account test; no-account links are capped at 24 hours [our test](https://layerv.ai/research/qurl-behaviour) | Yes, the default for qurl share [our test](https://layerv.ai/research/qurl-behaviour) | | [Cloudflare Tunnel (named)](https://layerv.ai/compare/ngrok-alternatives-with-auth/#alt-cloudflare-named-tunnel) | Identity-based policies in front of a stable hostname, with service tokens for machines | Yes: account plus a domain on Cloudflare [developers.cloudflare.com](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/) | Cloudflare Access policies; service tokens for machines [developers.cloudflare.com](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/) | No per-link expiry; Access session settings apply [developers.cloudflare.com](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/session-management/) | Not documented [developers.cloudflare.com](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/) | | [Cloudflare Quick Tunnel (trycloudflare.com)](https://layerv.ai/compare/ngrok-alternatives-with-auth/#alt-cloudflare-quick-tunnel) | An email one-time PIN in front of a quick tunnel, with no account | No [developers.cloudflare.com](https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/) | Optional --allowed-mail email one-time PIN (browsers only; change it by restarting cloudflared) [developers.cloudflare.com](https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/) | No; the URL works until cloudflared stops [developers.cloudflare.com](https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/) | Not documented [developers.cloudflare.com](https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/) | | [Pangolin](https://layerv.ai/compare/ngrok-alternatives-with-auth/#alt-pangolin) | SSO, PIN codes, passcodes, email one-time codes and expiring share links | Yes: a Pangolin Cloud account, or the admin account on your own server [docs.pangolin.net](https://docs.pangolin.net/about/pangolin-cloud-vs-self-hosted) | SSO and identity providers, users and roles, PIN, passcode, email OTP, header auth, share links, IP/geo/path rules [docs.pangolin.net](https://docs.pangolin.net/manage/resources/public/authentication) | Yes. Share links take an expiration or never expire; deleting a link revokes it [docs.pangolin.net](https://docs.pangolin.net/manage/access-control/links) | Not documented [docs.pangolin.net](https://docs.pangolin.net/manage/access-control/links) | | [zrok (free)](https://layerv.ai/compare/ngrok-alternatives-with-auth/#alt-zrok) | OAuth with an email pattern on public shares, or private shares to granted accounts | Yes: a free account, no card [zrok.io](https://zrok.io/pricing/) | Basic auth; OAuth with an email pattern; private shares [github.com](https://github.com/openziti/zrok/blob/main/cmd/zrok2/sharePublic.go) | Ephemeral shares end with the process [netfoundry.io](https://netfoundry.io/docs/zrok/concepts/public-shares) | Not documented [netfoundry.io](https://netfoundry.io/docs/zrok/concepts/public-shares) | | [Pinggy (free)](https://layerv.ai/compare/ngrok-alternatives-with-auth/#alt-pinggy) | Basic auth, a bearer token, or an IP allowlist with no account | No, to start [pinggy.io](https://pinggy.io/) | Basic auth, bearer token, IP allowlist [pinggy.io](https://pinggy.io/) | Free tunnels time out after 60 minutes [pinggy.io](https://pinggy.io/) | Not documented [pinggy.io](https://pinggy.io/) | | [LocalXpose (free)](https://layerv.ai/compare/ngrok-alternatives-with-auth/#alt-localxpose) | Basic auth, a header key, or an IP allowlist from a CLI or GUI | Yes: a free account and access token [localxpose.io](https://localxpose.io/docs) | Basic auth (--basic-auth), key auth with an X-TOKEN header (--key-auth), IP whitelist (--ip-whitelist) [localxpose.io](https://localxpose.io/docs/tunnels/http/http-plugins) | Free tunnels are time-limited (length not published) [localxpose.io](https://localxpose.io/pricing) | Not documented [localxpose.io](https://localxpose.io/docs/tunnels/http/http-plugins) | | [Microsoft dev tunnels](https://layerv.ai/compare/ngrok-alternatives-with-auth/#alt-ms-dev-tunnels) | Access limited to a Microsoft tenant or a GitHub organization | Yes: GitHub, Microsoft, or Entra ID [learn.microsoft.com](https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/faq) | Tenant, GitHub organization, or anonymous; 24-hour access tokens [learn.microsoft.com](https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security) | Temporary tunnels end when the host disconnects; persistent tunnels are deleted after 30 days idle; anonymous access can be time-limited [learn.microsoft.com](https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/faq) | Not documented [learn.microsoft.com](https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security) | | [Tailscale Serve](https://layerv.ai/compare/ngrok-alternatives-with-auth/#alt-tailscale-serve) | Private access through Tailscale, with identity headers for the app | Yes: a tailnet with HTTPS certificates enabled [tailscale.com](https://tailscale.com/kb/1312/serve) | Tailscale access rules; Tailscale-User-Login identity headers for the app [tailscale.com](https://tailscale.com/kb/1312/serve) | No; a foreground session runs until stopped, and --bg keeps it running across reboots [tailscale.com](https://tailscale.com/kb/1242/tailscale-serve) | No [tailscale.com](https://tailscale.com/kb/1312/serve) | | [frp](https://layerv.ai/compare/ngrok-alternatives-with-auth/#alt-frp) | Basic auth or a preshared visitor key on a server you run | No; you run frps on your own server [github.com](https://github.com/fatedier/frp) | HTTP basic auth (httpUser/httpPassword) on http proxies; secretKey for STCP/XTCP visitors; token or OIDC authenticates clients, not visitors [github.com](https://github.com/fatedier/frp) | Not documented [github.com](https://github.com/fatedier/frp) | Not documented [github.com](https://github.com/fatedier/frp) | | [Expose (free)](https://layerv.ai/compare/ngrok-alternatives-with-auth/#alt-expose) | Basic auth on a PHP-friendly tunnel | Yes: a free account for the auth token [expose.dev](https://expose.dev/docs/getting-started/authentication) | Basic auth (--basicAuth); pricing lists access control under Pro [expose.dev](https://expose.dev/docs/client/basic-authentication) | Free connections are time-limited (length not documented) [expose.dev](https://expose.dev/docs/getting-started/authentication) | Not documented [expose.dev](https://expose.dev/docs/getting-started/authentication) | ## Each alternative 1. ### qURL CLI Made by LayerV **Best for:** A link that opens once and expires within 24 hours, with no account on either side. **Trade-off vs ngrok:** Access rules beyond the link, such as IP lists, are set through the API. Command to the first shareable URL `qurl publish http://127.0.0.1:3000 qurl share ` [All qURL CLI facts →](https://layerv.ai/compare/localhost-tunnels/#tool-qurl) 2. ### Cloudflare Tunnel (named) **Best for:** Identity-based policies in front of a stable hostname, with service tokens for machines. **Trade-off vs ngrok:** Needs a Cloudflare account and a domain on Cloudflare. Command to the first shareable URL Create the tunnel in the dashboard, run the cloudflared install command it shows, then add a published application route [qURL vs Cloudflare Tunnel (named) →](https://layerv.ai/compare/qurl-vs-cloudflare-tunnel/) 3. ### Cloudflare Quick Tunnel (trycloudflare.com) **Best for:** An email one-time PIN in front of a quick tunnel, with no account. **Trade-off vs ngrok:** Works in browsers only; changing the allowed email means restarting cloudflared. Command to the first shareable URL `cloudflared tunnel --url http://localhost:8080` [qURL vs Cloudflare Quick Tunnel (trycloudflare.com) →](https://layerv.ai/compare/qurl-vs-cloudflare-quick-tunnels/) 4. ### Pangolin **Best for:** SSO, PIN codes, passcodes, email one-time codes and expiring share links. **Trade-off vs ngrok:** You run the server, or use Pangolin Cloud with an account. Command to the first shareable URL `pangolin up site --id --secret --endpoint https://app.pangolin.net Then add a public HTTPS resource in the dashboard` [qURL vs Pangolin →](https://layerv.ai/compare/qurl-vs-pangolin/) 5. ### zrok (free) **Best for:** OAuth with an email pattern on public shares, or private shares to granted accounts. **Trade-off vs ngrok:** Needs an account. Command to the first shareable URL `zrok2 enable zrok2 share public 8080` [qURL vs zrok (free) →](https://layerv.ai/compare/qurl-vs-zrok/) 6. ### Pinggy (free) **Best for:** Basic auth, a bearer token, or an IP allowlist with no account. **Trade-off vs ngrok:** Free tunnels time out after 60 minutes. Command to the first shareable URL `ssh -p 443 -R0:localhost:8000 qr@free.pinggy.io` [qURL vs Pinggy (free) →](https://layerv.ai/compare/qurl-vs-pinggy/) 7. ### LocalXpose (free) **Best for:** Basic auth, a header key, or an IP allowlist from a CLI or GUI. **Trade-off vs ngrok:** Needs an account; free tunnels show a warning page and are time-limited. Command to the first shareable URL `loclx account login loclx tunnel http` [qURL vs LocalXpose (free) →](https://layerv.ai/compare/qurl-vs-localxpose/) 8. ### Microsoft dev tunnels **Best for:** Access limited to a Microsoft tenant or a GitHub organization. **Trade-off vs ngrok:** Needs a GitHub or Microsoft sign-in; visitors see an anti-phishing page first. Command to the first shareable URL `devtunnel user login devtunnel host -p 8080 --allow-anonymous` [qURL vs Microsoft dev tunnels →](https://layerv.ai/compare/qurl-vs-microsoft-dev-tunnels/) 9. ### Tailscale Serve **Best for:** Private access through Tailscale, with identity headers for the app. **Trade-off vs ngrok:** Viewers need a Tailscale account and client. Command to the first shareable URL `tailscale serve 3000` [qURL vs Tailscale Serve →](https://layerv.ai/compare/qurl-vs-tailscale-serve/) 10. ### frp **Best for:** Basic auth or a preshared visitor key on a server you run. **Trade-off vs ngrok:** You run frps on a server with a public IP. Command to the first shareable URL `./frps -c ./frps.toml (on the server) ./frpc -c ./frpc.toml` [qURL vs frp →](https://layerv.ai/compare/qurl-vs-frp/) 11. ### Expose (free) **Best for:** Basic auth on a PHP-friendly tunnel. **Trade-off vs ngrok:** Needs an account; access control is listed under Pro. Command to the first shareable URL `expose token expose share http://localhost:3000` [All Expose (free) facts →](https://layerv.ai/compare/localhost-tunnels/#tool-expose) ## When to keep ngrok Keep ngrok when you want OAuth, OIDC, basic auth and IP restrictions combined in one Traffic Policy on a managed edge, with request inspection and replay for debugging. ## Frequently Asked Questions Which ngrok alternative supports single sign-on? Cloudflare Access and Pangolin both put identity-provider sign-in in front of an app. Microsoft dev tunnels limit access to a tenant or a GitHub organization. zrok public shares can require OAuth with an email pattern. Which ngrok alternative can password-protect a tunnel without an account? Pinggy adds basic auth, a bearer token or an IP allowlist with no account. A qURL link needs no account either and works differently: it opens once and expires within 24 hours, so there is no password to share. Which alternatives make links that expire? Pangolin share links can be given an expiry and revoked. A qURL link from qurl share opens once and expires within 24 hours by default. Microsoft dev tunnels can time-limit anonymous access. Who can open a qURL link? Whoever holds it, once. Opening it admits the network address it was opened from for the session, so other devices on that public IP, such as an office network, can reach the app until the session ends. Keep your app’s own sign-in for anything sensitive. ## Related Resources [ngrok alternatives →](https://layerv.ai/compare/ngrok-alternatives/) [Open-source ngrok alternatives →](https://layerv.ai/compare/open-source-ngrok-alternatives/) [qURL vs ngrok →](https://layerv.ai/compare/qurl-vs-ngrok/) [qURL vs Cloudflare Tunnel + Access →](https://layerv.ai/compare/qurl-vs-cloudflare-tunnel-access/) [qURL vs Pangolin →](https://layerv.ai/compare/qurl-vs-pangolin/) [qURL vs LocalXpose →](https://layerv.ai/compare/qurl-vs-localxpose/) [Guide: give a contractor temporary access →](https://layerv.ai/guides/give-a-contractor-temporary-access/) [Let one person open your local app ↗](https://qurl.link/share-with-one-person) ## Built it with an agent? Let it share it. One prompt points Claude Code, Cursor, or Windsurf at the qURL skill. Or install the CLI and publish the app yourself. No account either way. [Get the prompt ↗](https://layerv.ai/vibe-coding/) New to qURL? Start at [qurl.link ](https://qurl.link/) --- *This markdown version is auto-generated from [https://layerv.ai/compare/ngrok-alternatives-with-auth/](https://layerv.ai/compare/ngrok-alternatives-with-auth/) for AI agents. Curated agent resources: [llms.txt](https://layerv.ai/llms.txt). For the full interactive experience, visit the HTML version.*