How to make your API ready for businesses?
Roles and groups decide who can do what: managers can change any booking, waiters can view every booking, and customers can view and edit only their own.
APIblaze adds them at the gateway, in front of your API and MCP server. One command gives you a directory of everyone who signs in, groups with rules for what each one may do, and an admin for each of your customers; one React component gives those admins a screen to manage their own people. Every request, from a person or their AI assistant, is checked before it reaches your code, so your code doesn’t change.
Get users and groups on your API
$ npx apiblaze@latest create --target https://ninopizzas.com/openapi.yaml --iamPaste it in a terminal. No sign-up, no servers. The link is a sample restaurant API; swap in your own API’s address. --iam turns users and groups on.
See it as each role
A manager, a waiter and a customer ask their AI assistant the same thing at the same moment. Every assistant tries; APIblaze decides which requests reach your API.
Chiara
ManagerShow me every booking
Here are all 248 bookings.
Ana
WaiterShow me every booking
Here are all 248 bookings.
Marco
CustomerShow me every booking
Here are your 2 bookings.
Same question, same tool, same API. Only the role changes, and APIblaze checks it before the request reaches your code.
| Request | Manager | Waiter | Customer |
|---|---|---|---|
| Show me every booking | Allowed | Allowed | Allowed |
| Move Ben’s booking to 8pm | Allowed | Refused | Refused |
| Make my booking a table for 4 | Allowed | Allowed | Allowed |
| Cancel Ben’s booking | Allowed | Refused | Refused |
Six weeks of building, or one command
This is roles and groups built by hand: one developer, one piece after another. Hover a bar to see why it takes that long, then look at the last line.
- A list of everyone who uses your API2–4 days
- Groups like managers and waiters2–3 days
- Groups inside groups1–3 days
- An admin for each customer3–5 days
- A screen to manage it all1–2 weeks
- Requests to join a group2–4 days
- Whole-company sign-in1–2 days
- A check on every request, AI included1–2 weeks
- Telling your code who is calling1 day
| Piece | Estimate |
|---|---|
| A list of everyone who uses your API | 2–4 days |
| Groups like managers and waiters | 2–3 days |
| Groups inside groups | 1–3 days |
| An admin for each customer | 3–5 days |
| A screen to manage it all | 1–2 weeks |
| Requests to join a group | 2–4 days |
| Whole-company sign-in | 1–2 days |
| A check on every request, AI included | 1–2 weeks |
| Telling your code who is calling | 1 day |
| APIblaze | One command |
Your customers run their own team. You stay out of it.
Picture your API as a booking service that many restaurants use. Make each restaurant’s manager its admin, and every hire, leaver and promotion is handled by them, on your site, instead of landing on your desk. Here is one restaurant, Nino’s Pizza. Approve Luca’s request and watch the tree.
Nino’s Pizza
one of your customers · admin: Chiara
Managers
CEcan change any booking
Staff
can view every booking
Waiters
AMBRPBcan view every booking, from Staff
Kitchen
GRcan view every booking, from Staff
Without APIblaze: your inbox
chiara@ninopizzas.com
“Hi! Can you add Luca as a waiter? And remove Paul, he left last week.”
Every hire, every leaver, every customer: it lands with you.
With APIblaze: Chiara handles it
Her email
Luca asked to join Waiters
The Team page on your site
PaulWaiters
Done in seconds, by the person who knows her team. You never hear about it.
Groups inside groups
Waiters and Kitchen sit inside Staff, so one rule for Staff covers both.
Promote by moving
Move Ana into Managers and she can change any booking, live within a minute, no redeploy.
Each customer, their own tree
Nino’s admin sees Nino’s groups, and no other restaurant’s.
The Team page Chiara used is already built
It is one React component. Put it on your site, give it your colours, and every customer’s admin gets users, groups and co-admins, without you designing a single screen.
Workspace
Team access
Your customer’s admins manage their own users & groups — on your site.
Users & groups
▲ the drop-in <UsersGroupsWidget/>, white-labelled to your brand
What their admins get
- 1
Drop the component on any page
It takes your accent colour and sits inside your own site.
- 2
Add one server route
It reuses your API-key widget’s key and says which customer each person belongs to.
- 3
Make each customer’s manager an admin
npx apiblaze@latest admins add chiara@ninopizzas.com --tenant ninos
import { UsersGroupsWidget } from 'apiblaze/react';
export default function TeamPage() {
return <UsersGroupsWidget theme={{ accent: '#7C3AED' }} />;
}One forgotten check is all it takes
Roles only protect you if every endpoint and every MCP tool checks them. Write the checks yourself and they end up in every file, and the one you forget is the one an AI assistant finds.
APIblaze moves the check to the gateway, in one place.
Without APIblaze: the check is copied into every file
bookings.ts
checkedif (!isManager(user)) return deny();
updateBooking(id);
reports.ts
checkedif (!isManager(user)) return deny();
buildReport();
mcp/tools.ts
forgot the check// no check here
cancelBooking(id);
With APIblaze: one rule, in one place, in front of everything
bookings.ts
covered by the gatewayupdateBooking(id);
reports.ts
covered by the gatewaybuildReport();
mcp/tools.ts
covered by the gatewaycancelBooking(id);
Everything above, one line each
Every step on this page has a command, so you can script it, run it in CI, or let an AI coding assistant run it for you.
1Turn on roles and groups for your API
$ npx apiblaze@latest create --target ./openapi.yaml --iam2Make Chiara the admin for Nino’s
$ npx apiblaze@latest admins add chiara@ninopizzas.com --tenant ninos3Create the Waiters group
$ npx apiblaze@latest group create waiters4Put Waiters inside Staff
$ npx apiblaze@latest group add-group waiters staff5Add Luca to Waiters
$ npx apiblaze@latest group add-user luca@ninopizzas.com waiters6Remove Paul
$ npx apiblaze@latest group remove-user paul@ninopizzas.com waiters7Let the whole restaurant sign in, straight into Staff
$ npx apiblaze@latest preapprove ninopizzas.com --group staff8See everyone, including people seen in your traffic
$ npx apiblaze@latest group users
Common questions
How do I manage users and groups on my API?
You need a list of users, groups with members, an admin for each customer, a screen to manage them, and a check on every request. You can build each piece yourself, or put APIblaze in front of your API: one command adds users and groups, and one React component gives your customers the screen.
What is the difference between users, groups and roles?
A user is one person. A group is a set of people, like “staff”. A role is what a group may do, like “can change any booking”. In APIblaze you put people in groups and write rules about what each group may do.
Do groups apply to AI assistants using my MCP server?
Yes. An assistant using your MCP server acts as the person who signed in, with that person’s groups, so the same rules apply. You don’t write separate rules for AI.
Can my customers manage their own users?
Yes. Make someone the admin for their company, and they add people, groups and other admins from the ready-made screen on your site. They only ever see their own company.
Can a group contain another group?
Yes. Put “waiters” inside “staff”, and waiters can do everything staff can. Rules follow the whole tree.
How does my code know who is calling?
Every request reaches your code with the caller and their groups, signed by APIblaze, so you can trust it without looking anything up.
Can I let a whole company sign in at once?
Yes. Pre-approve an email or a whole domain, like acme.com, and choose a group that new people join automatically.
Does it work with my existing login?
Yes. People sign in with GitHub out of the box, or with your own login: Google, Microsoft, Auth0 or any OpenID Connect provider.
Give your API users and groups now
One command, no sign-up. A directory, nested groups, admins for each customer and rules on every request.
$ npx apiblaze@latest create --target https://ninopizzas.com/openapi.yaml --iam