npx apiblaze@latest skills · no signupServerless MCP & API GatewayEverything built-in for human and agent traffic
- Secured MCP
- Multi-tenant
- Self-serve API keys
- OAuth sign-in
- Authorization
- Throttling & quotas
- Localhost tunneling
- Custom domains
One prompt. No sign-up needed.Your MCP & API ready.
Your app goes behind a proxy and an MCP that bring everything production needs: multi-tenant, authentication (self-service API keys and OAuth), authorization with users and groups. In seconds.
~/code/mybackend $ npm run dev
⚡️ My app: A restaurant table booking app, running on localhost:3000
GET /reservations/{id} Get one booking
DELETE /reservations/{id} Cancel a booking
POST /reservations Book a table
~/code/mybackend $
Enable chat with your API
An OpenAPI spec becomes a serverless proxy, an MCP server, and a chat — humans and agents use it in one command.
Add “Get an API key” to your dev page
Drop one white-label widget on your site and your users mint their own API keys — zero auth code written.
Users, Groups & AuthZ for your API
Object-level authorization enforced at the proxy — OWASP #1 (BOLA), fixed in a blaze.
Enable chat with your API
One command turns your OpenAPI spec into a live proxy, an MCP server, and a chat. One React component puts that chat on your own site — your users book, query, and act by typing a sentence, and every step runs live through your API.
import { ChatWidget } from 'apiblaze/react'; <ChatWidget endpoint="/api/apiblaze/chat" title="Chat with Nino" avatar="🍕" suggestions={['Book a table for 2 tonight']} />
Nino’s Pizza
Wood-fired. Neapolitan. Midtown.
▲ the drop-in <ChatWidget/> — tools run live behind your proxy, white-labelled to your brand
Your users get API keys — from your website in seconds
Drop one React component on your own site and your signed-in users self-serve their API keys — create, rotate, revoke. It talks only to your backend; it never touches ours. Fully white-label through a theme prop.
Developer
API access
Create a key to call the Acme API from your app or CI.
Your API keys
▲ the drop-in <ApiKeyWidget/>, white-labelled to your brand
import { ApiKeyWidget } from 'apiblaze/react'; export default function Page() { return <ApiKeyWidget theme={{ accent: '#7C3AED' }} />; }
- import { ApiKeyWidget } from 'apiblaze/react' — mount the route from apiblaze/server
- Create · rotate · revoke, scoped per environment — masked, copy-once secrets
- open or invite-only signup, one switch — and keys can bind to your existing login
Users, groups & authorization — in a blaze
Drop one more React component on your site and your customers’ admins manage their own users & groups — nest a group inside a group — from your page. Then one plain-English rule enforces object-level access at the proxy, in front of your unchanged backend. This closes the OWASP #1 vulnerability (Broken Object-Level Authorization) without a line of code in your backend.
Workspace
User and group administration
Your customer’s admins manage their own users & groups — on your site.
Users & groups
▲ the drop-in <UsersGroupsWidget/>, white-labelled to your brand
import { UsersGroupsWidget } from 'apiblaze/react'; export default function Page() { return <UsersGroupsWidget theme={{ accent: '#7C3AED' }} />; }
- Drop <UsersGroupsWidget/> on your site — the SAME widget key as <ApiKeyWidget/>, one credential for both
- Customer admins self-serve: users, nested groups, co-admins, and provisioning identities seen in traffic
- Nested groups walk the tree (OpenFGA); one plain-English rule per resource, shadow-tested before you enforce
Manage groups in the widget or the CLI — then one plain-English rule resolves the whole tree at the proxy:
# 1 · groups, in the widget above or from the CLI
$ npx apiblaze group create admin
$ npx apiblaze group create staff
$ npx apiblaze group add-group staff admin # staff sits inside admin
$ npx apiblaze group add-user maria staff
# 2 · one rule, in plain English: tried in shadow mode, then enforced
$ npx apiblaze rule reserv \
"users see only their own reservations; anyone in admin sees all"
GET /reservations/42 john his own → 200
GET /reservations/42 alice not hers, not in admin → 403
GET /reservations/42 maria staff, inside admin → 200
Three commands. Zero infrastructure.
No infrastructure to maintain. Your backend never changes. No signup to try.
A spec becomes a live serverless proxy + MCP server, locked down from the spec. Say yes at the end and you are chatting with it.
Your users self-serve API keys from your own site — no portal detour, no auth code.
Object-level authorization enforced at the proxy, in front of your API.
Your MCP & API gateway, in one command
No signup required to try. Claim it to your account whenever you’re ready.