Reference
Authentication
API authentication and session management
Authentication
LawForge supports both anonymous and authenticated access.
Anonymous Access
No authentication required for basic usage:
- Rate limit: 5 requests/minute
- Monthly limit: 30 requests (IP-based tracking)
Authenticated Access
Sign up at lawforge.io/sign-up for higher limits.
Session Authentication
When using Claude Web or Claude Desktop, authentication is handled automatically through OAuth. Sign in to your LawForge account when prompted.
API Token Authentication
For programmatic access, use bearer token authentication:
curl -H "Authorization: Bearer YOUR_API_TOKEN" \
"https://api.lawforge.io/api/rest/v4/search/?q=first+amendment"Get your API token from lawforge.io/settings/api.
MCP Authentication
The MCP server supports session-based authentication. When connected through Claude, you'll be prompted to authenticate via OAuth if you have a LawForge account.
Authentication Endpoints
| Endpoint | Method | Description |
|---|---|---|
/auth/google | GET | OAuth with Google |
/auth/magic-link | POST | Email magic link login |
/auth/passkey | POST | WebAuthn/Passkey login |
/auth/logout | POST | End session |
Session Management
Sessions are managed via HTTP-only cookies:
| Cookie | Purpose |
|---|---|
session | Session identifier |
csrf_token | CSRF protection |
Sessions expire after 30 days of inactivity.
Response Headers
Authenticated responses include:
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 59
X-RateLimit-Reset: 1704067200