ENTERPRISE DEVELOPER CONSOLE
A headless, zero-trust command center for your API and Agentic products. Deploy secure credential vaults, hybrid OpenAPI documentation, and native community forums in minutes.
Step 2 — Security Architecture
SandboxProxyService ArchitectureMost API playgrounds are massive security vulnerabilities. They force users to paste raw API keys into the browser, exposing them to XSS attacks. Aforo's console uses a zero-trust backend proxy.
The developer configures the request. The browser sends only the endpoint path and body to the Aforo backend. Raw API keys are never present in the DOM.
The SandboxProxyService verifies the user's JWT, retrieves their active sk_live_ token from the Postgres vault, and injects the Authorization header server-side.
The proxy forwards the authenticated request to the Kong/Apigee gateway, captures the response, strips credentials, and returns execution timing to the browser.
Step 3 — Cryptographic Material
Keys are cryptographically generated using SecureRandom and immediately hashed via SHA-256 before storage. The raw secret is returned exactly once.
Step 4 — Developer Documentation
Aforo uses a hybrid approach to developer documentation. Hand-author conceptual guides in CommonMark Markdown via our split-pane editor, and let Aforo dynamically render your API reference directly from imported OpenAPI 3.0 or GraphQL specifications. No build steps. No rigid MDX compilers.
Hand-author conceptual guides in standard Markdown via our split-pane editor. No proprietary syntax, no MDX compilation step.
# Getting Started ## Authentication Pass your `X-Storefront-Key` header on every request.
Drop a spec URL or upload a YAML/JSON file. Aforo dynamically renders interactive API reference — no build step, no deployment.
POST /api/v1/docs/api-specs
{
"productId": "prod_xyz",
"specFormat": "OPENAPI_3",
"sourceUrl": "https://..."
}Hierarchical doc tree with parent_id self-FK, drag-to-reorder, max 3 levels deep. Version-controlled via doc_page_versions.
doc_pages( id, parent_id, product_id, title, slug, sort_order, status )
Step 5 — Community Infrastructure
Third-party forum integrations fracture the developer experience. Aforo provides a fully native community engine built directly into the console. No Discourse embed, no Intercom widget — your forum lives inside your portal, sharing your auth session.
Zero-trust key vault. Hybrid docs. Native community. AST-validated AI component builder. Every component is production-grade on day one.