Using ngrok’s Built‑In HTTP Request Inspection to Debug Tunnels

You can inspect every HTTP request and response that passes through an ngrok tunnel without adding any extra code. The inspection interface is available locally at http://127.0.0.1:4040 and as a REST API at http://127.0.0.1:4040/api/requests.

Enable inspection with a configuration file

Create a file named ngrok.yml in your working directory (or $HOME/.ngrok2/ngrok.yml) containing your authtoken and a tunnel definition:

authtoken: YOUR_AUTHTOKEN
tunnels:
  myweb:
    proto: http
    addr: 80
inspect: true   # optional; enabled by default for HTTP tunnels

Start ngrok with:

ngrok start --all

or, for a quick test:
ngrok http 80

After the tunnel is up, open a browser to http://127.0.0.1:4040 to see the dashboard, or run:
curl http://127.0.0.1:4040/api/requests

View requests via dashboard or API
The dashboard lists each request with method, URI, response code, and size. Clicking a request shows request and response headers and bodies. The API returns a JSON array where each element contains fields such as uri, method, code, req_id, and nested request and response objects.
Limits and common pitfalls

Inspection data is kept in memory only. By default ngrok stores the last 5 minutes of traffic; older entries are discarded to keep RAM usage bounded.
Restarting ngrok clears the inspection store; data does not survive a crash or a stop/start cycle.
The inspection interface is bound to the loopback address (127.0.0.1) by default. If you start ngrok with --remote-addr or bind it to a public interface, the dashboard and API become reachable from the network, potentially exposing sensitive headers, authentication tokens, or request bodies.
For high‑volume traffic, consider disabling inspection to save memory: set inspect: false in the tunnel definition or globally in ngrok.yml.
Older ngrok versions (< 2.0) do not include the inspection UI. Verify you are running at least version 2.0 with ngrok version.

To confirm that inspection works as expected:

Start a tunnel (e.g., ngrok http 80).
Open http://127.0.0.1:4040 in a browser and verify a list of requests appears after you make a few HTTP calls to the tunnel URL.
Alternatively, run curl http://127.0.0.1:4040/api/requests and check that the response is a JSON array containing request objects.
Stop ngrok with Ctrl+C, then start it again and repeat the curl request; the array should be empty or contain only the new requests, confirming the non‑persistent, in‑memory nature of the data.