How to stop a leaked API key from shutting down your system?
Give a booking app a key that can make reservations but never cancel them. If that key ever leaks, switch it off, and everyone else keeps working.
APIblaze handles all of it in front of your API. Every customer gets their own keys, each key gets a type that decides what it can do, and you can rotate, freeze or revoke any one of them on its own. Your customers can even manage their own keys from your site. Your code doesn’t change.
Put API keys in front of your API
$ npx apiblaze@latest create --target https://ninopizzas.com/openapi.yamlPaste it in a terminal. No sign-up, no servers. The link is a sample restaurant API; swap in your own API’s address. API keys are on from the start: every call then needs a key in an X-API-Key header.
The life of one key
Every key belongs to one customer, can be issued to one person, has a type, an environment, an expiry and its own rate limit. Rotate it, freeze it or revoke it below, and watch what a call made with it gets.
sk_prod_8f2Kq0LmTx_••••••••••••
Customer
Nino’s Pizza
Issued to
Chiara
Type
read-only
Environment
prod
Expires
in 87 days
Rate limit
10 a second
A read-only key for Nino’s Pizza
Issued to Chiara, so every call it makes counts as her. It can view bookings and nothing else, and it has its own rate limit.
GET /bookings · X-API-Key: sk_prod_8f2Kq0LmTx_••••
Allowed · Nino’s bookings
One key, the right doors
Scoped means a key opens only what it is for. You define key types in your dashboard, like read-only, partner and internal, and write one rule saying what each type may do. The gateway checks it on every call, before your code runs. Pick a key to see which doors it opens.
View bookings
GET /bookings
Opens
Make a booking
POST /bookings
Opens
Cancel any booking
DELETE /bookings/{id}
Stays locked
Export reports
GET /reports
Stays locked
The rule behind it, in plain English: “read-only keys can view bookings; partner keys can also make them; internal keys can do everything.” Each key’s scopes also reach your code, signed, for any finer checks you want there.
3am: a key leaks
A key check in your code says yes or no. It can’t pause one key, cap what a stolen one can do, or tell you what it did. Here is the same leak, twice.
APIblaze turns a leak into a one-key problem.
One shared key in your code
- 03:02
A key shows up in a public GitHub repo.
- 03:15
It turns out to be the one key every customer shares.
- 03:40
You replace it in your config and redeploy.
- 03:41
Every customer’s integration breaks at once.
- 09:00
What did the leaked key do overnight? There is no record.
Every customer down · no idea what happened
With APIblaze
- 03:02
A key shows up in a public GitHub repo.
- 03:03
You freeze that one key from your dashboard. Nothing else changes.
- 03:05
Its own rate limit had already capped how much it could do.
- 03:10
The log shows every call that key made.
- 03:12
You revoke it, and Nino’s Pizza makes a fresh key on your site. No other customer notices.
One key gone · nobody else affected · every call on record
Your customers manage their own keys
Put one React component on your developer page and your signed-in customers handle their keys themselves. No support tickets for a new key, and no keys sent by email.
Developer
API access
Create a key to call the Acme API from your app or CI.
Your API keys
▲ the drop-in <ApiKeyWidget/>, white-labelled to your brand
Create a key
Named for what it’s for, of a type you allow them.
See it again
Reveal a key when they need to copy it into a new place.
Rotate it
A fresh key, with the old one working for a grace period.
Revoke it
One key off, everything else untouched.
In your brand
One component on your site, in your colours. The browser never holds your APIblaze credential.
- How the key widget works
Keys from the command line
Everything on this page also works from the terminal: make keys for a customer or a person, see what your customers see, and call your API with a key.
A key for one customer
A key for Nino’s Pizza, and only Nino’s.
$ npx apiblaze@latest apikeys mint --tenant ninos --expires-days 30It expires on its own in 30 days.
A key for one person
A key issued to Chiara, Nino’s manager.
$ npx apiblaze@latest apikeys mint --tenant ninos --for chiara@ninopizzas.comEvery call it makes counts as her.
What your customers run
Your customers see and create their own keys.
$ npx apiblaze@latest consumer apikeysIt lists their keys, flags any about to expire, and offers to make a new one.
Call your API with a key
The key goes in an X-API-Key header.
$ curl https://ninopizzas.abz.run/1.0.0/prod/bookings -H "X-API-Key: sk_prod_…"Without a valid key, the gateway refuses the call before your code runs.
Freezing and revoking a customer’s key happen in your dashboard, or on the key page on your site.
Common questions
Put APIblaze in front of it. It gives your API a gateway that requires an API key on every call, sent in an X-API-Key header, with keys for each of your customers. Your code doesn’t change.
Answer
How do I add API key authentication to my API?
Put APIblaze in front of it. It gives your API a gateway that requires an API key on every call, sent in an X-API-Key header, with keys for each of your customers. Your code doesn’t change.
Prices are on the pricing page.
Put API keys in front of your API now
No sign-up, no servers. Keys for every customer, scoped by type, and rotated, frozen or revoked in a click.
$ npx apiblaze@latest create --target https://ninopizzas.com/openapi.yaml