auth

JWT authentication and API key authorization are implemented by configuring providers in forge.yaml and generating auth middleware. You can enforce unauthenticated allow-lists and apply RBAC rules using proto method annotations to secure backend services.

Role-based access control is enforced by marking RPC methods with required_roles using proto options. Running code generation produces the authorizer middleware that validates user roles against the annotated access rules for each method.

Multi-tenant isolation works by extracting tenant IDs from specific JWT claim fields. The system automatically scopes generated CRUD database queries using explicitly marked tenant_key fields to ensure strict data separation between tenants.

Yes, you can configure both JWT and API key authentication simultaneously via forge.yaml. The system generates unified middleware that standardizes authentication payloads into a shared Claims struct, including user_id, email, and org_id, regardless of the token type.

You can allow unauthenticated requests to specific endpoints by configuring an unauthenticated allow-list. This requires defining the excluded paths in your configuration before generating the auth middleware to bypass token validation for those routes.

An auth-ui pack is required if you need frontend login and signup components. It wires session UI components directly to your selected backend JWT provider, but the backend middleware itself functions independently for API security.