The Enterprise Developer Console
A headless, zero-trust command center for your API and Agentic products. Deploy secure credential vaults, hybrid OpenAPI documentation, and native community forums in minutes.
API Key + OpenAPI Spec. One Self-Serve Surface.
Every developer interaction in Aforo resolves to two inseparable artifacts. An API Key (the credential — sk_live_ or client_id+secret, SHA-256 hashed, subscription-bound). An OpenAPI Spec (the contract — rendered as interactive docs, executable via the zero-trust proxy, source of truth for 8-language code samples). They share the same JWT, the same vault, the same upstream gateway.
The auth artifact. Created via the customer portal, stored as SHA-256 hash, bound to a specific subscription via the key_subscription_bindings junction. Cancel the subscription and the key dies in the same transaction.
The discovery artifact. OpenAPI 3.0 YAML drives interactive API reference, the try-it-now playground, and 8-language code samples. CommonMark Markdown for conceptual guides. Both auto- republish when the spec changes.
Stripe's dashboard has keys but docs live on a separate site with no live-test. ReadMe.com has interactive docs but no auth or billing. Aforo merges both into one surface, sharing the same JWT and the same vault.
Interactive API Playground. Live Against Production.
Every endpoint in your OpenAPI spec gets a try-it-now widget. Configure the request, click Send, see the real response from your Kong / Apigee gateway. Code samples regenerate per language. All auth handled server-side via the zero-trust proxy.
/v1/translate{
"source_lang": "en",
"target_lang": "es",
"text": "Aforo handles
auth server-side.",
"model": "gpt-4o"
}curl -X POST \
https://dev.acme-api.com/v1/translate \
-H "Authorization: Bearer $AFORO_KEY" \
-H "Content-Type: application/json" \
-d '{"source_lang":"en",
"target_lang":"es",
"text":"...",
"model":"gpt-4o"}'The Authorization header reads "injected server-side", because that's exactly what happens. The browser never sees your real sk_live_ token. Same JWT session as the docs and the billing portal.
The SandboxProxyService Architecture
Most API playgrounds are massive security vulnerabilities. They force users to paste raw API keys into the browser, exposing them to XSS attacks. Aforo's console uses a zero-trust backend proxy.
1. Sanitized Payload
The developer configures the request. The browser sends only the endpoint path and body to the Aforo backend. Raw API keys are never present in the DOM.
2. Server-Side Injection
The SandboxProxyService verifies the user's JWT, retrieves their active sk_live_ token from the Postgres vault, and injects the Authorization header server-side.
3. Upstream Execution
The proxy forwards the authenticated request to the Kong/Apigee gateway, captures the response, strips credentials, and returns execution timing to the browser.
API Key Provisioning & Vault Storage
Keys are cryptographically generated using SecureRandom and immediately hashed via SHA-256 before storage. The raw secret is returned exactly once.
Hybrid Documentation Engine
Aforo uses a hybrid approach to developer documentation. Hand-author conceptual guides in CommonMark Markdown via our split-pane editor, and let Aforo dynamically render your API reference directly from imported OpenAPI 3.0 or GraphQL specifications. No build steps. No rigid MDX compilers.
CommonMark Authoring
Hand-author conceptual guides in standard Markdown via our split-pane editor. No proprietary syntax, no MDX compilation step.
# Getting Started ## Authentication Pass your `X-Storefront-Key` header on every request.
OpenAPI 3.0 Import
Drop a spec URL or upload a YAML/JSON file. Aforo dynamically renders interactive API reference, no build step, no deployment.
POST /api/v1/docs/api-specs
{
"productId": "prod_xyz",
"specFormat": "OPENAPI_3",
"sourceUrl": "https://..."
}Tree Navigation
Hierarchical doc tree with parent_id self-FK, drag-to-reorder, max 3 levels deep. Version-controlled via doc_page_versions.
doc_pages( id, parent_id, product_id, title, slug, sort_order, status )
Six Ingestion Tiers. Four SDKs. Five Gateways. One Pipeline.
Your developers pick the integration tier that matches their architecture. Network-level gateway plugins for zero-code. SDK decorators in 4 languages for instrumented apps. REST for full control. CSV upload for historical reconciliation. MCP sidecar for stdio / SSE / streamable-HTTP model-context-protocol servers. The in-product Integration Guide ships ready-to-paste code for every tier.
@aforo/meteringaforo-meteringcom.aforo:meteringgithub.com/aforo/metering-go@aforo/mcp-proxy sidecar (1 CLI command, no source-code change). Every tools/call JSON-RPC auto-metered per tool, per agent, per session. Or use @aforo/mcp-metering SDK (Node.js + Python) for direct integration.Native Community Forums
Third-party forum integrations fracture the developer experience. Aforo provides a fully native community engine built directly into the console. No Discourse embed, no Intercom widget, your forum lives inside your portal, sharing your auth session.
One Console. Four Stakeholders. Zero Friction.
Engineering, Product, Security, and DevRel each get the controls they need to ship a self-serve developer experience without stepping on each other. One vault, one spec, one community, one billing surface.
Engineering
Embed a production-grade dev portal in 1 sprint.
- 1Add the Aforo Storefront SDK to your marketing site under your own domain.
- 2Configure tenant-scoped X-Storefront-Key in your env vars.
- 3Developers self-serve sign-up, API keys, docs, playground, invoices — all under your brand.
- 4First customer onboards same day. No dev portal infrastructure to maintain.
Product / DX Lead
OpenAPI spec IS the docs AND the playground.
- 1Drop OpenAPI 3.0 YAML into the Documentation Hub.
- 2Aforo renders interactive API reference automatically; every endpoint gets a Try button.
- 3Spec updates auto-republish docs; code samples regenerate across 8 languages.
- 4No docs sprints. No drift. Source of truth is the spec your engineers already maintain.
Security / CISO
Developers test against prod safely.
- 1Developer clicks Try on POST /v1/translate in the docs.
- 2Browser sends endpoint + body only — no API keys in DOM, no XSS attack surface.
- 3SandboxProxyService validates JWT, retrieves sk_live_ from Postgres vault, injects header server-side.
- 4Request hits the gateway. Response strips credentials before returning to the browser.
DevRel / Customer Success
Native community deflects support tickets.
- 1Customer asks a question on the built-in forum — no Discourse embed, no Intercom widget.
- 2tsvector full-text search surfaces 3 similar past threads with weighted ranking.
- 3Peer answers; +5 reputation when marked as Solved; Top Contributor badge unlocks.
- 4Moderation queue surfaces flagged content; admin warns / soft-deletes / bans inline.
Ship a production-grade
Developer Console in a sprint.
Zero-trust key vault. Hybrid docs. Native community. AST-validated AI component builder. Every component is production-grade on day one.