A sign-in button
"Sign in with Forge" for your app, instead of building and running your own login.
All six parts of Forge
Flash · Identity
One sign-in, defined as code
Flash will give the people who use your apps one "Sign in with Forge" account, while each app sees only what it needs. It is running on our staging platform today and is not yet in production.
Built on Keycloak
Why it matters
Every app with its own login means another password to forget, another reset flow to build and another list of accounts to keep up to date when someone leaves.
Flash gives your apps one sign-in to share, with passkeys and a consent screen, and keeps its whole configuration in Git so every change is reviewed.
- where it runs today
- Staging
- checks on every app registration
- 18
How it works
One realm, in Git
The whole identity setup - settings, apps and rules - is code in a Git repository, applied by pipeline. Nothing is configured by clicking in a console.
Modern sign-in
Apps use OpenID Connect with PKCE. Passkeys are supported, brute-force protection is on and users see a consent screen.
Apps register by review
An app is added by a merge request. Automated checks test each registration against a list of rules before a person approves it.
Secrets stay out of Git
App secrets are kept in Vault and delivered to the cluster at runtime.
Live today
- Running on our staging platform, with smoke tests.
- Configuration as code, with automated checks on every app registration.
In progress
- Production launch.
- The first client apps using "Sign in with Forge".
What you get
Passkeys
Your users can sign in without a password.
Only what is needed
Each app is told only what it needs about a user, and the user sees what is shared.
Built on
Keycloak
A CNCF open-source identity and access management server.
keycloak-config-cli
Applies Keycloak configuration from files, so the realm can live in Git.
Related parts
Portcullis
The front door. It routes visitors to the right place, with a CDN caching public pages so they load fast. The cluster dials out to it, so it opens no web ports to the internet.
Keystone
How our services find each other, and how browsers and services know they are really talking to us.
Graft
Every setting lives in Git. Change the file and the platform follows - so there is a record of everything.