Forage · Authentication Profile

Forage Authentication

Authentication

Forage secures its APIs with oauth2 and http across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials flow(s).

CompanyPaymentsEBTSNAPEBT CashHSA/FSAFintechGovernment BenefitsGroceryCheckoutFinancial-Services

Methods: oauth2, http Schemes: 2 OAuth flows: clientCredentials API key in:

Security Schemes

authentication_token oauth2

session_token http

scheme: bearer

Source

Authentication Profile

generated: '2026-07-19'
method: searched
source: https://docs.joinforage.app/docs/authentication
docs: https://docs.joinforage.app/docs/authentication-concepts
summary:
  types: [oauth2, http]
  scheme: bearer
  oauth2_flows: [clientCredentials]
  model: >-
    OAuth 2.0 bearer tokens. Long-lived authentication tokens are minted from a
    Client ID + Client Secret for server-side requests; short-lived session tokens
    are minted from an authentication token for client-side / SDK requests. Tokens
    are passed in the HTTP Authorization header.
schemes:
- name: authentication_token
  type: oauth2
  flow: clientCredentials
  description: >-
    Long-lived OAuth 2.0 bearer token created with a POST to /o/token/ using the
    app's Client ID and Client Secret from the Forage dashboard. Used in the
    Authorization header of server-side requests for sensitive tasks (create order,
    capture payment). Default expiry 7 days (604800s), configurable up to 30 days.
    Up to 1000 active tokens per Client ID/Secret pair; revoke via /o/revoke_token/
    or /o/bulk_revoke/.
  token_endpoint: https://api.joinforage.app/o/token/
  revoke_endpoint: https://api.joinforage.app/o/revoke_token/
  bulk_revoke_endpoint: https://api.joinforage.app/o/bulk_revoke/
  expiry_default_seconds: 604800
  scope: server-side
- name: session_token
  type: http
  scheme: bearer
  description: >-
    Short-lived OAuth 2.0 bearer token created with a POST to /session_token/ from
    a valid authentication token. Expires after 15 minutes. Required for client-side
    requests and SDK methods that submit customer data (e.g. create PaymentMethod).
  token_endpoint: https://api.joinforage.app/session_token/
  expiry_seconds: 900
  scope: client-side
notes:
- The Merchant-Account header is required for HSA/FSA and credit/debit payment methods;
  optional for EBT payment methods (EBT PaymentMethods are tenant-scoped).
- Sandbox credentials are managed at https://dashboard.sandbox.joinforage.app/ and
  production at https://dashboard.joinforage.app/.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/forage-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.