APIblazeAPIblaze
One npm install apiblaze · no signup

One serverless proxy.
Instant AI superpowers.

Put any API behind a proxy and MCP server in one command — then chat with it, hand your users API keys, and control who sees what. No infrastructure.

Chat with your API.

Point it at any OpenAPI spec and get a live serverless proxy, an MCP server agents can call, and a working chat — in one command.

Chat Keys Users, Groups & Authorization
Start free npm install apiblaze Demo

or run npx apiblaze apichat --openapi <url>

npx apiblaze apichat
$ npx apiblaze apichat --openapi https://apiblaze.com/pokeapi_openapi.yaml
✔ Proxy provisioned as https://pokeapik9x2.abz.run
✔ MCP server published as https://pokeapik9x2.mcp.abz.run
Chat with your API · pokeapik9x2.mcp.abz.run
you › what are pikachu's abilities?
✓ getPokemon (238ms)
curl -sS -X GET 'https://pokeapik9x2.abz.run/…/pokemon/pikachu'
assistant › Pikachu has the abilities static and lightning-rod.
💳 $0.0106 · gemini-2.5-flash · balance $0.94

Chat with your API

An OpenAPI spec becomes a serverless proxy, an MCP server, and a chat — humans and agents use it in one command.

Add “Get an API key” to your dev page

Drop one white-label widget on your site and your users mint their own API keys — zero auth code written.

Users, Groups & AuthZ for your API

Object-level authorization enforced at the proxy — OWASP #1 (BOLA), fixed in a blaze.

Add “Get an API key” on your API dev page

Your users get API keys — from your website in seconds

Drop one React component on your own site and your signed-in users self-serve their API keys — create, rotate, revoke. It talks only to your backend; it never touches ours. Fully white-label through a theme prop.

acme.dev/developers

Developer

API access

Create a key to call the Acme API from your app or CI.

Your API keys
yJt••••••z7r
Created 7/13/2026 · Never used
prod
Aq0••••••tbX
Created 7/13/2026 · Never used
prod
6Cl••••••E5z
Created 7/13/2026 · Never used
prod

▲ the drop-in <ApiKeyWidget/>, white-labelled to your brand

app/keys/page.tsx
import { ApiKeyWidget } from 'apiblaze/react';
export default function Page() {
  return <ApiKeyWidget theme={{ accent: '#7C3AED' }} />;
}
  • import { ApiKeyWidget } from 'apiblaze/react' — mount the route from apiblaze/server
  • Create · rotate · revoke, scoped per environment — masked, copy-once secrets
  • open or invite-only signup, one switch — and keys can bind to your existing login
Read the widget docs
Users, Groups & AuthZ for your API

Users, groups & authorization — in a blaze

Drop one more React component on your site and your customers’ admins manage their own users & groups — nest a group inside a group — from your page. Then one plain-English rule enforces object-level access at the proxy, in front of your unchanged backend. This closes the OWASP #1 vulnerability (Broken Object-Level Authorization) without a line of code in your API.

acme.dev/team

Workspace

Team access

Your customer’s admins manage their own users & groups — on your site.

Users & groups
▸Admins2 admins
▾front-desk3 members
alice@acme.commember
maria@acme.commember
subgroups:reservationists
Search users to add…
▸Seen in traffic3 new

▲ the drop-in <UsersGroupsWidget/>, white-labelled to your brand

app/api/apiblaze/groups/route.ts · app/team/page.tsx
// one server route — the SAME widget key as <ApiKeyWidget/>
import { createApiblazeGroups } from 'apiblaze/server';
export const POST = createApiblazeGroups({
  cpKey: process.env.APIBLAZE_CP_KEY!,
  getUser: () => session(),  // { tenant, userId, email }
}).handler;

// …then drop the component on your page
return <UsersGroupsWidget theme={{ accent: '#7C3AED' }} />;
  • Drop <UsersGroupsWidget/> on your site — the SAME widget key as <ApiKeyWidget/>, one credential for both
  • Customer admins self-serve: users, nested groups, co-admins, and provisioning identities seen in traffic
  • Nested groups walk the tree (OpenFGA); one plain-English rule per resource, shadow-tested before you enforce
Explore authorization

Manage groups in the widget or the CLI — then one plain-English rule resolves the whole tree at the proxy:

npx apiblaze — authorization, enforced at the proxy

# 1 · a proxy that identifies every caller

$ npx apiblaze create --target api.reserv.io --identify

✓ live · every call carries an identity (a key or an end-user id)

# 2 · a reservation is created BY a user

$ curl -X POST …/reservations \

-H "X-API-Key: sk_live_…" -H "X-End-User-Id: john"

✓ 201 · owner = john (captured at the proxy)

# 3 · build groups — from the widget above, or the CLI / CI

$ npx apiblaze group create admin

$ npx apiblaze group add-user maria reservationists

$ npx apiblaze group add-group reservationists admin # nest a group in a group

# 4 · one rule in plain English — shadow-tested, then enforce

$ npx apiblaze rule "users see only their own

reservations; children of admin see all" reserv --enforce

# OpenFGA walks the relationship tree:

GET /reservations/42 # john · owner → 200

GET /reservations/42 # alice · nobody → 403

GET /reservations/42 # maria ∈ reservationists ⊂ admin → 200

groups:admin⊃reservationistsenforcing

Three commands. Zero infrastructure.

No infrastructure to maintain. Your backend never changes. No signup to try.

Chat01
npx apiblaze apichat --openapi <url>

Turn a spec into a live serverless proxy + MCP server + chat you can talk to right now.

Keys02
<ApiKeyWidget /> on your dev page

Your users self-serve API keys from your own site — no portal detour, no auth code.

Users & groups03
npx apiblaze rule "…own rows only"

Object-level authorization enforced at the proxy, in front of your API.

The AI-ready serverless proxy — in one command

No signup required to try. Claim it to your account whenever you’re ready.

$ npx apiblaze apichat
Start free Get the CLI