Test locally

Set up an integration

Run the Forum locally at http://localhost:3007. In the Genesis Admin dashboard, open Forum integrations, create an integration such as local-partner, enable the capabilities you want to test, and copy the API key when it is displayed.

Store it in your terminal session:

export FORUM_API_KEY='gfi_the_key_from_admin'

Use fake local users and content only.

Test Genesis-generated linking

Request an opaque link with curl, copy the url from the response, and open it in a private browser window:

curl -i -X POST http://localhost:3007/api/integrations/link \
  -H "Authorization: Bearer $FORUM_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: local-link-user-001" \
  -d '{"uuid":"local-user-001","username":"local_reader","email":"your-test-email@example.com","destination":"/"}'

Test decline, existing password sign-in, existing OAuth sign-in, and new-account creation with separate UUIDs and idempotency keys.

Test partner-signed linking

Enable signed links and register your test public signing JWK and kid in Admin. Your backend must create the signed JWT and encrypted JWE described in Partner-generated signed links, using the local Genesis encryption public key.

Then open http://localhost:3007/link?id=<compact-JWE>. Curl can submit or open a finished token, but it cannot manufacture a valid cryptographic JWT/JWE by itself. Test expired exp, wrong aud, unknown kid, changed ciphertext, duplicate jti, accept, and decline.

Test comment ingestion

curl -i -X POST http://localhost:3007/api/integrations/posts \
  -H "Authorization: Bearer $FORUM_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: local-comment-001" \
  -d '{
    "uuid":"local-user-001",
    "username":"local_reader",
    "novel":"Local Test Novel",
    "chapterNumber":5,
    "timestamp":"2026-07-28T10:30:00+09:00",
    "content":"Local imported comment test."
  }'

Repeat the exact request to verify created: false. Then test an omitted timestamp, missing novel without creation capability, disabled capability, invalid key, oversized or invalid fields, and rate limiting.