How to protect your API with your login?
You already have an API and a login. APIblaze uses one to protect the other.
Every call is checked against your login before your API runs, and your code is told who is calling. Works with Auth0, Clerk, Supabase and most other login providers.
Put APIblaze in front of your API
$ npx apiblaze@latest create --target https://ninopizzas.com/openapi.yamlPaste it in a terminal. No sign-up, no servers. The link is a sample restaurant API; swap in your own. Then add your login in the project’s Authentication tab.
Four checks, before your code runs
Three tokens arrive at your booking API. One is from a signed-in user, one expired yesterday, and one was issued for a different app.
A signed-in user
eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2VyXzhkMWYi….Qm9va2luZ3Mh…
- iss
- https://login.yourapp.com/
- aud
- bookings-api
- sub
- user_8d1f
- exp
- in 55 minutes
- Signed with your provider’s key
- Not expired
- Issued by your login
- Meant for this API
Sent to your API with:
x-abz-user-id: user_8d1f
Three values from your provider, one place in APIblaze
Pick your provider to see what to copy, and watch where it goes in your project’s Authentication tab. Paste a sample token and APIblaze fills the values in for you.
What to copy from your provider
- Issuer
- https://YOUR_DOMAIN/
- Audience
- Your API’s identifier in Auth0
- JWKS URL
- https://YOUR_DOMAIN/.well-known/jwks.json
Keep the trailing slash on the issuer: it must match the token exactly.
Where it goes in APIblaze
Press Add issuer. Every call is now checked against your login.
Prefer the terminal? Pass them when you create:
npx apiblaze@latest create --target https://api.yourapp.com --oauth '{"iss":"https://YOUR_DOMAIN/","aud":"bookings-api","jwks":"https://YOUR_DOMAIN/.well-known/jwks.json"}'The check you stop writing
Today, each of your services checks tokens itself. Behind APIblaze, that code goes away and your service just reads who is calling.
import { createRemoteJWKSet, jwtVerify } from 'jose';
const JWKS = createRemoteJWKSet(
new URL('https://YOUR_DOMAIN/.well-known/jwks.json'),
);
app.use(async (req, res, next) => {
const token = req.headers.authorization?.replace('Bearer ', '');
if (!token) return res.status(401).end();
try {
const { payload } = await jwtVerify(token, JWKS, {
issuer: 'https://YOUR_DOMAIN/',
audience: 'bookings-api',
});
req.userId = payload.sub;
next();
} catch {
res.status(401).end();
}
});app.use((req, res, next) => {
req.userId = req.headers['x-abz-user-id'];
next();
});Bad, expired and wrongly signed tokens never reach this code. When your provider rotates its keys, APIblaze picks up the new ones.
Common questions
- Which login providers work?
- Any that signs its tokens with a public key and publishes that key at a JWKS address. That covers Auth0, Clerk and Supabase, and most other OpenID Connect providers, including your own.
- What exactly does APIblaze check?
- That the token is signed with your provider’s key, has not expired (with a minute of leeway for clock drift), was issued by your login, and is meant for your API.
- What happens when my provider rotates its keys?
- Nothing for you to do. When a token arrives signed with a key APIblaze has not seen, it fetches your provider’s key list again.
- What does my API receive?
- The request, plus the user’s id in x-abz-user-id and a signed identity header. Callers cannot send these headers themselves: APIblaze removes any they try.
- Can I use something other than sub as the user id?
- Yes. In the issuer’s settings, pick another claim from the token, such as email, and APIblaze uses it to identify the user. Tokens must still carry a sub.
- Does it work with Supabase?
- Yes, with Supabase’s JWT signing keys. Projects still on the legacy shared secret need to switch to signing keys first.
- Does it work with Clerk?
- Yes, once your tokens carry an audience. Add an aud claim in a Clerk JWT template and send that token to your API.
- What stops someone calling my backend directly?
- Have APIblaze send your backend a secret header on every call, and have your backend refuse calls without it. One command sets it up.
Prices are on the pricing page.
Secure your API with your own login
No sign-up, no servers. Every token checked before your API runs, and the user’s id handed to your code.
$ npx apiblaze@latest create --target https://ninopizzas.com/openapi.yaml