Open Source Authentication

Forge Auth

Central authentication for the BlueForge ecosystem. Single sign-on across all your apps — plus organizations, tenancy, device-flow API keys, and org-level billing, resolved from one identity platform.

Self-Hosted

Your Keys, Your Data

Everything You Need for Auth

Identity, tenancy, and billing for the whole BlueForge portfolio — one platform, nothing extra to run.

Organizations & Tenancy

Multi-tenant identity for every BlueForge app: organizations with owners, admins, and members, a personal org for every user, and invitations — all resolved from a single session.

Single Sign-On

One OAuth flow shared across the whole ecosystem. Google, GitHub, and Gitea credentials live here and federate to each app — plus an MCP OAuth resource server for mcp.app.* subdomains.

Device-Flow API Keys

Desktop CLIs log users in once, then issue user-bound keys for unattended calls. Sibling apps resolve any key back to its owning user through the /api/v1/users/resolve verifier.

Federation Service Accounts

Federation Spec 1: mint scoped service accounts from the admin console, exchange them for short-lived JWTs, and resolve them on every call — no shared human credentials between services.

Plans & Entitlements

Stripe checkout, portal, and webhooks attach platform plans at the org level. Apps read plan and entitlements (like financials.apps.max) instead of running their own billing.

Webhook Events

HMAC-signed organization.*, member.*, invitation.*, and key.* events fan out to every connected app, with idempotency keys and retries — so mirrors stay fresh without polling.