Authentication & Sessions
Forge Core is built on Better Auth for email/password sign-up, sign-in, email verification, and password reset, with two-factor authentication and passkeys layered on top. Session management extends Better Auth's own model with cross-app revocation.
Email & password
Standard sign-up, sign-in, email verification, and forgot/reset password flows, all exposed under Better Auth's /api/auth/* routes. The first account to verify its email is automatically promoted to the owner role.
Two-factor authentication & passkeys
Users can turn on TOTP-based two-factor authentication (an authenticator app, with backup codes) from the Account page, and register passkeys as a password-less alternative — sign in with a device's fingerprint, face, or screen lock. Both are optional, per-account settings.
Sessions
Every sign-in creates a session row, whether it's a direct dashboard login or a "Sign in with Forge" grant issued to a sister app (see /docs/oauth). The Account page's "Active sessions" card lists every session for the signed-in user, labeled by which app it belongs to.
Revoking sessions — and why it cascades to OAuth grants
Revoking a session doesn't just delete a row — it goes through Better Auth's own adapter so the OAuth provider plugin's cleanup hook fires too, revoking that session's access/refresh tokens and dispatching back-channel logout to any sister app that registered a backchannelLogoutUri. A raw database delete would skip all of that and leave a banned or deactivated user's "Sign in with Forge" grants live until they naturally expired.
| Action | Who can do it | Effect |
|---|---|---|
| Sign out this device | Any user, on their own session | Revokes one session |
| Sign out of all devices | Any user, on their own account | Revokes every session, including the current one |
| Revoke all sessions (admin) | A role with members.revoke-sessions | Revokes every session for a target member |
| Ban / deactivate a member | A role with members.ban / members.deactivate | Revokes every session for that member as a side effect |
Where each action lives
Self-service actions are on the Account page (/account). Admin actions are on the Members page (/dashboard/members) — hover a member's "Active" status badge to see their sessions and, with permission, revoke them all.
Related permissions
members.view-sessions— see which apps a member is signed intomembers.revoke-sessions— revoke all of a member's sessionsmembers.ban,members.deactivate— both also revoke sessions as a side effect
See /docs/rbac for the full permission model.