Skip to main content
GroundForge accepts two public authentication patterns.

​
User and CLI bearer token

Use an OIDC bearer token for user-driven administration:
This is the same identity model used by the web application and gforge login.

​
Service-account API key

Use a scoped API key for an external Agent or another runtime identity:
Create a separate Service Account and credential for each integration. Limit it to the intended Organization, Workspace, Agent, or Gateway use.

​
Provider callbacks

Twilio and Mailgun inbound callbacks do not use the bearer or API-key pattern. GroundForge verifies the provider signature with the credential stored on the Channel. Never place bearer tokens, API keys, signing secrets, or model credentials in request content, screenshots, Trace metadata, or Git repositories.
Last modified on July 27, 2026

Related topics

REST API OverviewWeather MCP ExampleMCP ProvidersTroubleshooting