Open Source Authentication

Forge Auth

Central authentication for the BlueForge ecosystem. Single sign-on across all your apps — plus organizations, tenancy, device-flow API keys, and org-level billing, resolved from one identity platform.

A glowing shield with a keyhole at its centre, linked by threads of light to a ring of app tiles: one BlueForge identity signing in to every app. — Self-Hosted
Your Keys, Your Data

Everything You Need for Auth

Identity, tenancy, and billing for the whole BlueForge portfolio — one platform, nothing extra to run.

Four glass blocks of member nodes, each wired to one central shield.

Organizations & Tenancy

Multi-tenant identity for every BlueForge app: organizations with owners, admins, and members, a personal org for every user, and invitations — all resolved from a single session.

A single glowing key radiating beams to a ring of app tiles.

Single Sign-On

One OAuth flow shared across the whole ecosystem. Google, GitHub, and Gitea credentials live here and federate to each app — plus an MCP OAuth resource server for mcp.app.* subdomains.

A laptop terminal passing a key along a dotted arc to a phone that confirms it.

Device-Flow API Keys

Desktop CLIs log users in once, then issue user-bound keys for unattended calls. Sibling apps resolve any key back to its owning user through the /api/v1/users/resolve verifier.

A row of server modules on a lit track, handing glowing tokens to one another.

Federation Service Accounts

Federation Spec 1: mint scoped service accounts from the admin console, exchange them for short-lived JWTs, and resolve them on every call — no shared human credentials between services.

A glass payment card beside three rising tier pillars, the tallest marked with a check.

Plans & Entitlements

Stripe checkout, portal, and webhooks attach platform plans at the org level. Apps read plan and entitlements (like financials.apps.max) instead of running their own billing.

A central hub sending envelopes of light along curved paths to surrounding nodes.

Webhook Events

HMAC-signed organization.*, member.*, invitation.*, and key.* events fan out to every connected app, with idempotency keys and retries — so mirrors stay fresh without polling.