Authentication

Base URL: https://api.agentic.forwardlane.com External developers authenticate with a tenant member API key (beta), sent as a bearer token on every protected request:

export FL_API_KEY="your-tenant-member-api-key"

curl -H "Authorization: Bearer $FL_API_KEY" \
  "https://api.agentic.forwardlane.com/api/skills/by-ontology?concept=fibo:Account"

API keys are issued per organization member and are organization scoped. Keep them in environment variables or a secret manager — never commit them, embed them in examples as real values, or ship them in browser-delivered JavaScript.

Public endpoints

Exactly these endpoints require no credential:

Endpoint	Purpose
`GET /health`	Liveness probe.
`GET /docs`	Interactive OpenAPI UI.
`GET /openapi.json`	OpenAPI schema.
`GET /v1/billing/plans`	Active plan catalog.
`GET /v1/catalog`	Machine-readable product catalog (all 16 products, live/coming-soon status, docs links).
`GET /v1/products/{slug}`	Per-product descriptor; coming-soon products return a `501` envelope.

Everything else requires a credential — including / (the API root), which is an operations endpoint, not a public one.

Product endpoints (`/api/*`)

The six live product endpoint suites accept tenant member API keys as Authorization: Bearer. A request with a missing bearer and a request with a wrong bearer both return 401 — there is no 403 distinction for bad credentials on /api/*.

Commercial control plane (`/v1/*`)

Tenant-scoped /v1/* routes (billing, usage, reports, CLI bridge) use the same tenant member API key. Role-gated operations (for example checkout sessions, which require an owner) return 403 when your key’s identity lacks the required role. POST /v1/cli/pair is not unauthenticated: on the production (Postgres) deployment it requires a Better Auth owner JWT inside the request payload to issue a pairing code. Pair through the supported flow instead of calling it directly:

fl-repos cloud login
fl-repos cloud status

Once paired, fl-repos cloud publish, fl-repos cloud runs, and fl-repos cloud usage use the tenant credential. Run fl-repos doctor to diagnose local configuration. Service JWTs and service principals exist but are internal/enterprise mechanisms — they are not the way external developers integrate during the beta.

Webhooks

POST /v1/billing/webhooks/polar authenticates with Polar webhook signature headers. It does not accept a bearer token.

Error semantics

Every 401 and 403 response body carries a docs_url field pointing back to this guide:

{
  "detail": "Invalid or missing credentials",
  "docs_url": "https://docs.agentic.forwardlane.com/authentication"
}

Status	Meaning	What to do
`401`	Missing, malformed, expired, or invalid credential — on `/api/*` this covers both absent and wrong bearers.	Check the key value and that it is sent as `Authorization: Bearer`.
`403`	Valid identity without the required role or permission (role-gated `/v1/*` operations).	Ask an organization owner to grant the documented role.
`409`	Idempotency or state conflict.	Reuse the original idempotency key only when retrying the same operation; otherwise read current state.
`422`	Request failed parameter or body validation.	Correct the named field using the endpoint schema.
`501`	Coming-soon product (`GET /v1/products/{slug}`).	The envelope includes `waitlist_url` and `docs_url`.
`503`	A required service or data store is unavailable.	Retry after the dependency recovers.

Beta notes

Credits run in shadow mode during the beta: usage is metered (GET /v1/billing/usage) but nothing is charged.
Per-call x402 payments are coming soon; they are not accepted today.

Get Started

Products

API Reference

CLI

FL Web

Python SDK

MCP Server

Graph Schema

Authentication

Authentication

Public endpoints

Product endpoints (`/api/*`)

Commercial control plane (`/v1/*`)

Webhooks

Error semantics

Beta notes

​Authentication

​Public endpoints

​Product endpoints (/api/*)

​Commercial control plane (/v1/*)

​Webhooks

​Error semantics

​Beta notes

Authentication

Public endpoints

Product endpoints (`/api/*`)

Commercial control plane (`/v1/*`)

Webhooks

Error semantics

Beta notes