API Reference
Every Forge Core route lives under /api except OIDC discovery, which the spec requires at the issuer root.
The full, always-current reference is Swagger
Forge Core serves interactive OpenAPI docs at {FORGE_BASE_URL}/api/docs — e.g. http://localhost:3030/api/docs locally. That's generated straight from the route schemas, so it's the authoritative source for exact request/response shapes, not this page. This table exists to orient you before you go look something up there.
Route groups
| Path | Covers |
|---|---|
| /api/health | Health check |
| /api/auth/* | Better Auth — sign-up, sign-in, sessions, oauth2/*, jwks |
| /api/users/* | User-facing account endpoints |
| /api/core/auth/* | Centralized auth verification (API keys + sessions) |
| /api/core/members/* | Member management — ban, deactivate, delete, sessions |
| /api/core/account/* | Self-service account actions |
| /api/core/clients/* | API key (ForgeClient) management |
| /api/core/oauth-apps/* | OAuth application management |
| /api/core/roles/* | Custom role management |
| /api/core/invitations/* | Member invitations |
| /api/core/email-templates/* | Transactional email template customization |
| /api/core/settings/* | Project & auth settings |
| /api/core/notifications/* | Dashboard notification feed |
| /api/core/dashboard/* | Dashboard analytics |
| /.well-known/openid-configuration | OIDC discovery document (registered at the bare root, not under /api, per the OIDC spec) |
Authenticating requests
Two independent mechanisms, checked by /api/core/auth/verify in one call:
Backend-to-backend (API key)
x-forge-api-key: fk_live_...
User session
Authorization: Bearer <session token>
See /docs/api-keys for API keys and /docs/authentication for sessions.
Error shape
JSON
{
"error": "invalid_api_key",
"message": "Human-readable description"
}Standard HTTP status codes throughout — no custom status scheme.