Auth Configuration

Manage per-project authentication providers, redirect URLs, and SDK configuration via the forge-auth integration.

Endpoint

/api/platform/projects/:id/auth

/api/platform/projects/:id/auth

Parameters

id

providers

["email", "google", "github"]

redirectUrls

Response

// GET — Auth config + users
{
  auth: {
    appId: string
    providers: string[]       // e.g. ["email", "google", "github"]
    redirectUrls: string[]
    configured: boolean       // true once forge-auth app exists
  }
  users: Array<{
    id: string
    email: string
    provider: string
    createdAt: string
    lastLoginAt: string | null
  }>
  sdkConfig: {
    url: string
    anonKey: string
  }
}

// PATCH — Update providers
{
  auth: {
    appId: string
    providers: string[]
    configured: boolean
  }
}

Examples

# Get auth config
curl https://api.blueforge.studio/api/platform/projects/prj_xxx/auth \
  -H "Authorization: Bearer $BF_TENANT_KEY"

# Enable Google and GitHub OAuth
curl -X PATCH https://api.blueforge.studio/api/platform/projects/prj_xxx/auth \
  -H "Authorization: Bearer $BF_TENANT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"providers": ["email", "google", "github"]}'

# Update redirect URLs
curl -X PATCH https://api.blueforge.studio/api/platform/projects/prj_xxx/auth \
  -H "Authorization: Bearer $BF_TENANT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"redirectUrls": ["https://myapp.com/auth/callback"]}'

import { Client } from "@blueforge/client"

// Get config
const config = await client.projects.auth.get("prj_xxx")
console.log("Providers:", config.auth.providers)

// Update providers
await client.projects.auth.update("prj_xxx", {
  providers: ["email", "google", "github"]
})

Pitfalls

• The first PATCH call for a project auto-registers a forge-auth application if none exists. This cannot be undone via the API.
• Changing providers may invalidate existing user sessions. Notify your users before removing a provider.
• Redirect URLs must be absolute HTTPS URLs. HTTP is rejected except for localhost development.
• The

  sdkConfig

  object is read-only reference data for client SDK initialization; it cannot be modified through this endpoint.

See also

• hosting.domains.provision-ssl — SSL certificate provisioning
• Auth providers are configured per-project; see the Platform API overview for provider setup

Tested against

• @blueforge/platform-api: 2.4.1
• Last verified: 2026-07-15