Sign Up & API Keys
Create an account at app.reforg.io . Signing up creates your organization — templates, API keys, and usage all belong to it.
Your three credentials
Open Settings → API Keys in the dashboard. Your organization has three credentials:
| Credential | Looks like | Where it may live | Used for |
|---|---|---|---|
| Public key | pk_live_… | Browser code — safe to expose | Rendering directly from your frontend |
| Secret key | sk_live_… | Server only — never ship to a browser | Full API access from your backend |
| Signing secret | random string | Server only | Signing user IDs for the frontend handshake (x-user-hash) |
Rotating keys (the Rotate keys button, or POST /v1/auth/rotate-keys with a secret key) regenerates all three credentials at once and invalidates the old ones immediately. Any integration using the old keys stops working until updated.
Allowed domains (frontend rendering only)
If you plan to render from the browser with your public key, add your site’s hostname to Allowed domains in Settings. The API rejects public-key requests whose Origin isn’t on this list (exact hostname or any of its subdomains).
You can skip this for now if you only render from your backend — the secret key doesn’t use the allowlist.