Secure & control

Fine-grained authz, no code

Rules like “users see only their own reservations” — written in plain English, tested watch-only against your real traffic, then enforced on every request in front of your unchanged backend (OpenFGA under the hood).

One rule in plain English: npx apiblaze rule
Ownership, roles, groups & attributes
Starts watch-only: reports what it would block, blocks nothing
When the rule engine is down, requests are denied, not leaked

Start free Read the docs

npx apiblaze rule — enforced at the proxy

$ npx apiblaze rule "users see only their own \
    reservations; children of admin see all" reserv --enforce

  ✓ OpenFGA model + route rule published · enforcing

GET /reservations/42  # john  · owner            → 200
GET /reservations/42  # alice · nobody           → 403
GET /reservations/42  # maria ∈ …⊂ admin         → 200

Authorization as a first-class feature

Relationship-based

Model owners, members and roles the way OpenFGA does — at the route.

Watch-only first

See what a rule would allow or deny on real traffic before you turn it on.

Fail-closed

If the policy engine is unreachable, requests are denied, not leaked.

Try it in 30 seconds

No signup required. Claim it to your account whenever you’re ready.

Start free Read the docs

Explore more:All of Secure & control Social login in a click API keys with real scopes