IAM API overview

The IAM APIs let your application authenticate and manage tenant users. Gate endpoints handle registration, login, and password flows at the edge. Public endpoints handle tokens, profile, TOTP, and JWKS without Cloudflare Worker invocation.

Authentication

All Gate and Public endpoints require an API key with auth permission. Send it in the X-API-Key header:

X-API-Key: your_project_api_key_here

Public endpoints that act on a specific user also need a Bearer JWT access token:

Authorization: Bearer eyJhbGciOiJSUzI1NiIs...

Base URLs

Replace {project_id} with your project’s UUID.

Surface	Base URL	Protection
Gate API	`https://org-api.hexoforge.dev/api/v1/gate/{project_id}/auth`	Cloudflare Worker (DDoS, firewall, IP rules, rate limits)
Public API	`https://org-api.hexoforge.dev/api/v1/pub/{project_id}/auth`	Backend-only (IP rules, firewall, rate limits)
JWKS	`https://org-api.hexoforge.dev/api/v1/pub/{project_id}/.well-known/jwks.json`	No API key or Bearer

Rate limiting

Every endpoint is rate-limited. Default limits are configurable per project:

Category	Default limit	Applied to
`login`	10 requests per minute per IP	`/login`, `/login/totp`
`register`	5 requests per minute per IP	`/register`
`password_reset`	5 requests per minute per IP	`/forgot-password`, `/reset-password`
`general`	30 requests per second per IP	All other endpoints

When rate-limited, you receive 429 Too Many Requests with IETF-compliant headers:

HTTP/1.1 429 Too Many Requests
RateLimit-Policy: 10;w=60
RateLimit: limit=10, remaining=0, reset=45

Gate endpoints also have a hard cap of 60 requests per minute per IP at the Cloudflare edge (not configurable).

​Authentication

​Base URLs

​Rate limiting

Authentication

Base URLs

Rate limiting