Forge Core Documentation

Everything you need to install Forge Core, understand what it does, and integrate it into your own apps — from environment setup to the OAuth2/OIDC provider and the client SDK.

New to Forge Core? Start with Installation to get the API server and admin dashboard running locally, then explore the feature guides below. Building an integration that lets users sign in with their Forge account? Jump straight to Sign in with Forge and the Client SDK.

Authentication & Sessions

Email/password sign-up, 2FA, passkeys, and cross-app session revocation.

API Keys

Issue, disable, revoke, and expire programmatic access keys.

A full OAuth2/OIDC provider so other apps can sign in with a Forge account.

Roles & Permissions

Fine-grained RBAC — grant exactly the permissions a role needs.

Resource Tokens

Short-lived, resource-scoped signed tokens — the signed-URL primitive.

Security & Rate Limiting

Per-client rate limits, audit logging, CORS, and JWKS key rotation.

Admin Dashboard

Member management, Cmd+K search, and a live notifications feed.

Background Worker

A separate process handling daily cleanup and unused-key flagging.

Client SDK

@casteluke/forge-client — a framework-agnostic SDK plus React hooks.