Developer Terms of Use

1. Agreement

By registering an OIDC client with ForgeSystems via POST /oauth2/register (or any future successor registration endpoint) and by using the access credentials returned (client_id, client_secret, registration_access_token, state_secret) in any capacity, you ("Developer") agree to these Developer Terms of Use. If you are registering on behalf of an organization, you represent that you have authority to bind that organization.

The party offering the Service is IRIS Systems LLC, a Texas limited liability company, operating the ForgeSystems platform at forgesystems.io ("ForgeSystems," "we," "us").

Registrations made when the platform's DCR_PUBLIC=true flag is enabled are required to include a terms_accepted_at ISO-8601 timestamp in the registration body to record acceptance of this document.

2. Permitted Use

You may use the registered OIDC client and the ForgeSystems identity surface (/oauth2/authorize, /oauth2/token, /oauth2/userinfo, /oauth2/revoke, /oauth2/logout, discovery, JWKS) to:

• Authenticate ForgeSystems end-users into your application via the OIDC authorization_code + PKCE flow.
• Read identity claims authorized by the user-granted scope (openid, email, profile, offline_access).
• Refresh access tokens via the refresh_token grant with rotation.
• Self-service your client metadata via the RFC 7592 management endpoints using the registration access token.

3. Prohibited Use

You may not, and may not enable others to:

• Resell or sublicense the credentials you receive. Credentials are non-transferable. Register a separate client per product / environment.
• Circumvent rate limits via distributed or rotating source IPs, botnets, or captcha farms. The documented limits are a ceiling, not a target.
• Scrape or enumerate ForgeSystems user data beyond what a legitimate authorization flow returns. The sub, email, and profile claims are for your own user-account linkage, not for bulk identity collection.
• Register decoy or spam clients. One registration per legitimate integration.
• Impersonate ForgeSystems or IRIS Systems LLC in end-user communications. "Log in with ForgeSystems" as a button label is fine. Claiming to be ForgeSystems in email or support material is not.
• Store user credentials. The OIDC flow exists specifically so you never see the user's ForgeSystems password. Any attempt to phish or capture user credentials results in immediate termination and likely referral to law enforcement.
• Retain user PII beyond the scope the user granted. If your user revokes the refresh token, stop using data derived from their identity claims.
• Bypass PKCE for public clients. Public clients (token_endpoint_auth_method=none) must use S256 PKCE on every authorize request. Attempting to register a public client that skips PKCE is itself a breach.

4. Data Handling

• User PII you receive (email, email_verified, name, given_name, family_name, picture, updated_at, sub) is ForgeSystems end-user data that the user has consented to share with your app via OIDC scopes. You are a data processor for your own linkage needs. You may store what you need to operate your service (e.g. linking sub to your internal user ID).
• Retention: retain identity claims only as long as the end-user has an active account in your application. When the user closes their account in your app, delete the identity claims within 30 days.
• Breach notification: if you experience a data breach involving identity claims sourced from ForgeSystems, notify developers@forgesystems.io within 72 hours of discovery, including the scope of affected users (if known) and your remediation plan.
• GDPR / CCPA basics: you are responsible for your own regulatory compliance with respect to end-users in jurisdictions that apply to your app. Honor user deletion requests in your own app; ForgeSystems will honor them at the identity-provider layer.
• No resale of PII under any regulatory regime.

5. Rate Limits

ForgeSystems enforces per-IP rate limits published in the Developer Getting Started guide under "Rate limits." Exceeding the limits returns HTTP 429 with a retry-after hint; respect the hint. Sustained 429 patterns indicate a misconfigured client and may trigger manual review.

6. Intellectual Property

• Your application and everything you build on top of the OIDC flow remains your property.
• ForgeSystems platform, including the forgesystems.io brand, the ForgeSystems name and logo, the platform code, and the OIDC surface, is operated by IRIS Systems LLC. Intellectual-property ownership may also be governed by written assignments and licenses.
• Client library artifacts you use (openid-client, authlib, go-oidc, etc.) are governed by their own licenses.
• No trademark license is granted by registration. A "Log in with ForgeSystems" button is fine; don't use the logo in a way that implies endorsement.

7. Termination

ForgeSystems may terminate your client registration (soft-archive) for:

• Breach of Sections 3 (Prohibited Use), 4 (Data Handling), or 5 (Rate Limits).
• Legal compulsion (court order, regulatory action).
• Platform-wide end-of-life of a given OIDC surface with at least 90 days public notice.
• Your own voluntary DELETE call on the RFC 7592 management endpoint.

On termination, existing access tokens expire on their normal 15-minute TTL; refresh tokens no longer rotate; new authorize requests return invalid_client. Identity claims already in your possession must be handled per Section 4 retention rules.

You may reinstate after termination only with a fresh registration and, where termination was for cause, after written acknowledgment of the cause.

8. Disclaimer of Warranty

The OIDC surface is provided "AS IS." ForgeSystems disclaims all warranties, express or implied, including fitness for a particular purpose and non-infringement. We do not warrant uninterrupted availability. The full disclaimer in the platform Terms of Service at forgesystems.io/terms.html applies to you as a Developer in addition to these Developer Terms.

9. Limitation of Liability

To the maximum extent permitted by law, IRIS Systems LLC's aggregate liability arising from or related to your use of the OIDC surface is limited to USD 100 or the fees you paid ForgeSystems in the 12 months preceding the claim, whichever is greater. ForgeSystems is not liable for indirect, incidental, consequential, or punitive damages.

10. Governing Law

These Developer Terms are governed by the laws of the State of Texas, United States, without regard to conflict-of-laws principles. Exclusive venue for any dispute is state or federal court located in Potter County or Randall County, Texas.

11. Changes to Terms

ForgeSystems may update these Developer Terms. Non-material changes are effective on publication. Material changes (changes that reduce your rights or increase your obligations) are announced at least 30 days in advance via the email addresses in your registered contacts field. Your continued use of the OIDC surface after the effective date of a material change constitutes acceptance.

12. Contact

• Developer questions, integration help, rate-limit appeals: developers@forgesystems.io
• Security disclosures: developers@forgesystems.io with subject prefix [SECURITY]
• Abuse reports: developers@forgesystems.io with subject prefix [ABUSE]

V1.1 prepared for licensed-attorney review. Operator updated 2026-07-13. This status does not represent attorney approval.