Authentication
Send a credential on every request as a bearer token.
Authorization: Bearer fg_...API keys
Make, name and revoke keys in Settings > Account > API access. A key acts as your account: what it starts is yours in the app and runs on your credits. Forge keeps only a hash of it, so it is shown once; the list shows when each key was last used.
Read and writeStart conversations, send messages, and read everything below.
Read onlyList conversations, get their status and read their messages. A write answers 403 with
insufficient-scope.Revoking a key stops every program using it on its next request.
OAuth
An app that acts for other Forge users signs them in with OAuth 2.1 (authorization code with PKCE, and dynamic client registration). The API's protected-resource metadata names the authorization server:
https://mcp.forge.team/.well-known/oauth-protected-resourceRequest the scopes conversations:read and conversations:write. MCP clients sign in this way on their own.