Skip to content
Scalpels home

Scalpels is officially launching on October 31, 2026. Special early adopter pricing is available now.

← All documentation

Documentation

Scalpels

Connect Laravel Forge

Updated

Connect Forge when you want Scalpels to discover existing Forge sites and attach them to a provider product. Only the team Owner can connect, replace, or disconnect this credential because it can reach the team's servers and environment files.

Create the token

Create a Forge API token with exactly these scopes:

  • user:view identifies the Forge account.
  • organization:view lists organizations.
  • server:view lists servers and sites and reads a site's environment file.
  • site:manage-environment writes the variables used by an attachment.

Do not grant additional scopes for Scalpels. Its Forge integration does not create servers, delete sites, deploy applications, or manage certificates.

Connect the account

  1. Open Team settings → Laravel Forge.
  2. Paste the token and select Connect.
  3. Scalpels verifies it with Forge's account endpoint before storing it.

The account identity is recorded so replacing the token cannot silently redirect work to another Forge user. The token is encrypted at rest, cleared from the form after every attempt, and never rendered back. The page shows only a short hint.

The environment-file write

Forge does not provide a key-by-key environment update. Its update endpoint replaces the site's whole .env file. For that reason, an attachment performs one read-merge-write operation:

  1. Read the current complete file.
  2. Replace or append only the recipe's keys, plus BFC_CLIENT_IDENTITY, which identifies the connection, while preserving existing keys, comments, blank lines, order, quoting, line endings, and trailing newline.
  3. Write the complete merged file back.

Scalpels does not decode or persist the existing values. It refuses the write if the current file cannot be accounted for safely, including an unclosed quoted value, an unreadable line or value, or a requested key that appears more than once. A refusal leaves the file untouched.

Disconnect

Disconnecting removes Scalpels' copy of the token. It makes no Forge API call, does not revoke the token in Forge, and does not change any server, site, or environment file. Revoke the token separately in Forge when required.