Forge Auth

0 of 7 features shipped · 0 verified

• One OAuth flow shared across every BlueForge app — Google, GitHub, and Gitea credentials live in Forge Auth and are federated to each consumer.

  Status not declared

• MCP OAuth resource server for the `mcp.app.<product>.blueforge.studio` subdomain family, so any portfolio app can mount an MCP endpoint without re-wiring auth.

  Status not declared

• Device-flow user-bound API keys — a desktop CLI logs the user in once, then issues scoped keys for unattended calls; the same client can resolve a key back to the owning user via the `/api/v1/users/resolve` verifier.

  Status not declared

• Organizations behind `FORGE_AUTH_ORGANIZATIONS` — Better Auth's org plugin wired into the central database, with personal orgs, invitations, role mapping from legacy teams, and per-plan entitlements (e.g. `financials.apps.max`) read by sibling apps like financials-os.

  Status not declared

• Federation Spec 1 service accounts — scoped, mintable from the admin console, and accepted on the same `/api/teams` and `/api/admin` routes as signed-in users.

  Status not declared

• Stripe checkout + portal + webhook with a subscription table that flips the org's plan between `free` / `basic` / `pro` / `team` / `enterprise`.

  Status not declared

• Webhook emitter — `organization.*`, `member.*`, `invitation.*`, `app.*`, `key.*` and `forge-git` user-cache events all carry a flat JSON contract that sibling apps can consume.

  Status not declared