Reforge · Authentication Profile

Reforge Authentication

Authentication

Reforge secures its APIs with apiKey across 2 declared security schemes, as derived from its OpenAPI definitions.

CompanyFeature FlagsFeature ManagementDynamic ConfigurationLive ConfigExperimentationDeveloper ToolsSDKObservability
Methods: apiKey Schemes: 2 OAuth flows: API key in: sdk-key

Security Schemes

BackendSdkKey apiKey
· in: sdk-key ()
FrontendSdkKey apiKey
· in: sdk-key ()

Source

Authentication Profile

reforge-authentication.yml Raw ↑ 
generated: '2026-07-21'
method: searched
source: https://docs.reforge.com/docs/tutorials/get-started
docs: https://docs.reforge.com/docs/tutorials/get-started
summary:
  types: [apiKey]
  api_key_in: [sdk-key]
  oauth2_flows: []
  note: >-
    Reforge is SDK-key authenticated; there is no OAuth authorization surface, so
    no scopes/ artifact applies.
schemes:
- name: BackendSdkKey
  type: apiKey
  in: sdk-key
  env: REFORGE_BACKEND_SDK_KEY
  legacy_env: PREFAB_API_KEY
  description: >-
    Server-side SDK key with full access to the environment's configuration and
    flag data. Passed to the SDK at init (Reforge.init(sdk_key: "<SDK-KEY>")) or
    via the REFORGE_BACKEND_SDK_KEY environment variable.
  sources: [https://docs.reforge.com/docs/tutorials/get-started]
- name: FrontendSdkKey
  type: apiKey
  in: sdk-key
  description: >-
    Client/mobile SDK key restricted to single-user flag evaluation; hides raw
    flag rules and configuration data so it is safe to ship in browser/mobile
    clients.
  sources: [https://docs.reforge.com/docs/tutorials/get-started]
key_management:
  displayed_once: true
  storage: secure hash only
  rotation: generate an additional key, then retire the old one