The whole platform, from your terminal

Turn any API into a chat: point at an OpenAPI spec (or just --target and let it discover the spec) and start asking questions. No login needed — it creates a live proxy + MCP server (Claude/ChatGPT-connectable via GitHub sign-in), then every answer shows the real call it made. Logged in, access defaults to invite-only (just you + emails you pre-approve); anonymous proxies stay open.

Chat with an assistant that builds and runs your APIs — describe what you want and it makes the calls (billed per turn).

Interactive OpenAPI designer. Reviews captured traffic, proposes spec patches, then /publish — or opens a GitHub PR back to your repo.

Interactive access-rules designer. Drafts who-can-do-what rules per route; publishes watch-only, /enable to enforce.

Interactive MCP catalogue designer. Pick which routes become tools, then /publish to {project}-{tenant}.mcp.apiblaze.com.

Optional: store your own LLM provider key locally (OpenRouter / Anthropic / DeepSeek / OpenAI) — lifts chat model quality, bills your key.

Create a proxy — no login needed. It works immediately and prints your live endpoint, API keys, and a claim link: open that link later to create an account and keep the proxy (otherwise it’s cleaned up after 72h with no traffic).

Set up the sidecar in a Next.js app: every external call your app makes surfaces in the dev console; approve one and it routes through APIblaze with zero code changes.

Route an origin through APIblaze (creates its proxy). deny dismisses a candidate; remove un-routes it and deletes the proxy.

Put your localhost behind a public URL and stream every request in real time. Auto-creates a proxy if you don’t have one; captures requests even before your server is up.

Device-flow login (via GitHub). Opens your browser, stores your token and active team.

Keep what you built while logged out: attaches those proxies (and their keys & settings) to your account. Omit the code on the machine you created them from; --team puts them in an existing team instead of a new one.

Switch the active team (prompts if you have more than one).

Show who you are — both API Producer and API Consumer identities — plus active team and token expiry.

Sign out (asks whether to drop the Producer or Consumer login).

Browse and change EVERY proxy setting & feature — interactive menu with no arguments, git-config-style get/set with them (e.g. config myapi throttling.proxyQuota 10000). Works logged-out to explore.

List every project in your active team.

Manage tenants — the workspaces your consumers live in. Bare command opens the interactive picker (settings, app clients, providers).

Manage a tenant’s users & groups — create, nest a group inside a group, add users. Bare command lists groups; group users shows the directory + identities seen in traffic.

Crown a tenant’s admins for the Users & Groups widget — the widget authorizes the signed-in user and seals its admin list, so the FIRST admin is seeded here by the key holder. Accepts the widget’s tenant ref (e.g. nino) or the real tenant name.

Turn users & groups on for a proxy’s tenant: identified calls (X-End-User-Id, a login token, or a per-user key) get their user’s groups applied — group rules and per-user limits take effect. Off = calls pass with no group resolution.

Require every call to say which person it’s for. require rejects unattributed calls loudly (403) instead of silently passing them with no groups — the credential says which app is calling; identity says which person it acts for. allow-anon lifts it.

Allow someone to sign in to an access-restricted API — one email (someone@acme.com) or a whole company domain (acme.com = anyone @acme.com). Rules are tenant-wide and pair with an API set to “pre-approved users only” (the same control as apichat’s invite mode). --list shows the allow-list; --remove drops an entry.

Write an access rule in one shot — e.g. "users see only their own rows". Starts watch-only (reports what it would block, blocks nothing); --enforce turns it on (billed per turn).

Use your own domain: add shows the DNS records to set; status tracks validation & TLS; set-base picks which version/environment your main URL serves.

Change where a proxy forwards requests — per environment with --env.

Set rate limits and quotas: per-user and per-end-user requests/second, plus a proxy-wide quota.

Print the current OpenAPI document; spec set replaces it from a local file. (To build one by chatting: apiblaze agent openapi.)

Change a proxy’s display name.

Migrate out: export config and data as a runnable Kong OSS bundle (decK config + plugins + docker-compose). Consumers keep their existing keys via hash export.

Delete a proxy and everything under it (asks first).

Log in to a tenant’s portal as a consumer (device flow).

List your consumer API keys (reveals expiring ones), then offer to create one.

Show the logged-in consumer access / refresh / id tokens.