Source: docs/integration/auth.md

Authentication — API key

The Forgium administrator provides an API key for each environment. Use it with

the Public API (/v1/*):

Authorization: Bearer <FORGIUM_AGENT_API_KEY>

Obtain access

Request these values from the Forgium administrator:

FORGIUM_AGENT_BASE_URL=<value issued for the target environment>
FORGIUM_AGENT_API_KEY=<value issued out of band>

Store the key in the host application's secret manager. Do not commit it,

include it in a capability manifest, or put it in logs.

If a request returns 401, ask the administrator to verify or replace the key.

Capability endpoints also receive a short-lived Forgium-Context Ed25519

JWS. Validate its issuer, audience, kid, time claims, exact method and URL,

body hash, and replay ID before accepting a request. Retrieve verification keys

from /.well-known/forgium/capability-context/v1/jwks.json; never request or

store a private signing key.

Rotate endpoint tokens with the token rotation runbook.

Example

curl -fsS "$FORGIUM_AGENT_BASE_URL/v1/capabilities" \
  -H "Authorization: Bearer $FORGIUM_AGENT_API_KEY"