One gateway. Every capability.
Host any API, secure it without code, and make it AI-native — all from one command line and one dashboard.
Ship & run
Put any API live on its own subdomain — no infrastructure, no deploy step.
Tunnel localhost, stream live traffic
Run npx apiblaze dev to expose your local server through a public, secured endpoint — and watch every request, header and response stream into your terminal in real time.
Sidecar your Next.js app
npx apiblaze init wires the sidecar into your app: every external call it makes shows up in your dev console. Approve an origin and its traffic routes through APIblaze — auth, rate limits, observability — with zero code changes.
Versions, environments & instant rollback
Run dev, staging and prod with separate upstreams and keys, ship new API versions side-by-side, and roll back to any previous config in one move.
Auto-discover undocumented routes
APIblaze watches real traffic and surfaces endpoints that aren’t in your spec yet — deduped into clean path templates, so /users/42 and /users/99 collapse to /users/{id}. Review them in the dashboard, or let the OpenAPI agent document them.
Reshape requests & responses
Map JWT claims to headers, hardcode values, rewrite payloads and look up values in mapping tables — applied at the edge, before your backend ever sees the request.
Your API on your domain
Keep the free *.apiblaze.com subdomain or bring your own — APIblaze shows you the DNS records to set, then provisions and manages the hostname and TLS for you.
Secure & control
Authentication and fine-grained access control, configured not coded.
Social login in a click
Turn on OAuth with GitHub, Google, Microsoft, Facebook or Auth0 — APIblaze hosts the login, verifies tokens with the provider, and holds them encrypted only as long as your app needs them.
API keys with real scopes
Issue, rotate, freeze and scope API keys per consumer — and define your own key types with custom scopes beyond the built-ins.
“Get an API key” on your own site
Drop one React component on your dev page and your signed-in users mint, rotate and revoke their own API keys — in your brand. The browser talks only to your backend; your backend holds the APIblaze credential.
Bring your own JWT issuer
Trust any OIDC provider — register issuer/audience pairs with a JWKS URL and APIblaze verifies incoming JWTs and resolves the end-user id from the claim you choose.
Fine-grained authz, no code
Rules like “users see only their own reservations” — written in plain English, tested watch-only against your real traffic, then enforced on every request in front of your unchanged backend (OpenFGA under the hood).
Groups & self-service access
Organize consumers into nested groups, pass abz.groups to your backend, and let users request group membership with an approve/reject workflow.
Users & groups, managed on your site
Drop one more React component on your site and your customers’ admins manage their own users and nested groups — from your page, in your brand. Same widget key as the API-key widget: one credential for both.
Rate limits, quotas & credits
Protect your backend and your bill: per-user rate limits, per-proxy and per-team quotas, plus prepaid credit metering with a hard stop when you opt in.
AI-native
Turn your API into something agents can call, and let AI write the config.
Chat with your API
Point apichat at any OpenAPI spec and start asking questions — no login needed. Under the hood you get a live serverless proxy, an MCP server, and a chat that actually calls your API and shows its work.
Publish an MCP server
Expose any proxy as a Model Context Protocol server so Claude, Cursor and other agents can call your API as a tool — tenant-isolated and OAuth-gated.
Real tools over JSON-RPC
Each selected route becomes a typed tool with a name and description, invoked over JSON-RPC 2.0 with proper path/query/body marshalling and streaming.
OpenAPI specs from real traffic
Chat with the OpenAPI agent — it reads captured traffic, proposes additive, protected-block-safe spec patches, and can open a pull request back to your repo.
Authorization rules by conversation
Describe who should access what; the AuthZ agent drafts an OpenFGA model and per-route rules, validates them, and dry-runs against your traffic before you enable.
Build your MCP catalogue by chat
The MCP agent derives tool candidates from your routes, helps you name and describe them, and publishes the catalogue — no JSON by hand.
A hosted developer portal
Every proxy gets a zero-config portal where your users log in, get API keys, manage groups and try endpoints live in an OpenAPI viewer — on your subdomain.
See it for yourself
Ship a real API live, with no signup, in 30 seconds.