Admin Dashboard
The Forge UI dashboard for managing everything above without touching the API directly — members, invitations, roles, API keys, OAuth apps, and settings, plus quick search and a live notifications feed.
Member management
The Members page (/dashboard/members) lists every user with search, filtering, and sorting, and supports the full lifecycle: invite, set role, ban/unban, deactivate/reactivate, soft-delete/restore (with a 30-day grace period before permanent purge), and password reset. Hovering a member's "Active" status shows which apps they're signed into and, with the right permission, lets you revoke all their sessions — see /docs/authentication.
Cmd+K search
Press ⌘K (or click the search box in the header) to open a command palette searching across members, invitations, API keys, and OAuth apps at once. Each category is only searched if the signed-in user has that category's *.view permission — a caller without one just gets that category back empty, no separate permission logic in the palette itself. Selecting a result navigates to that entity's list page.
Notifications
The bell icon in the header shows a curated, per-viewer feed of recent security events — bans, deactivations, deletions, new API keys, new OAuth apps, revocations, secret rotations, and unused-key flags — with an unread-count badge. Opening the bell marks everything as read. This reads from the same audit trail described in /docs/security, filtered down to what's actually worth a human's attention.
Everything else in the dashboard
/dashboard/invitations— send, resend, and revoke invitations/dashboard/roles— create and configure custom roles (owner-only)/dashboard/api-keys— issue, disable, enable, and revoke API keys/dashboard/oauth-apps— register and manage OAuth applications/dashboard/email-templates— customize transactional email content/dashboard/auth-settings— sign-up policy, 2FA enforcement, rate limit thresholds, post-login redirect/dashboard/settings— general project settings/account— the signed-in user's own profile, 2FA, passkeys, and active sessions
Everything here is permission-gated
Every page and action above checks a specific permission from /docs/rbac — what a signed-in user sees in the sidebar and can do on each page depends entirely on their role's granted permissions.