APIblazeAPIblaze
One npm install apiblaze · no signup

One serverless proxy.
Instant AI superpowers.

One command. Connect agents to your API. API keys from your website. Users, groups & authorization in a blaze.

Chat with your APIs with Claude, Codex & your site

Turn your API specs into live MCPs and chat widgets on your own website in one command. Never read an API doc again.

Create a proxy, MCP and chat with it
$ npx apiblaze create --target https://ninopizzas.com/openapi.yaml --auto
✔ Proxy provisioned as https://ninopizzak9x2.abz.run
✔ Dev portal at https://ninopizzas.portal.apiblaze.com/1.0.0
✔ MCP server published as https://ninopizzak9x2.mcp.apiblaze.com
$ npx apiblaze apichat
? Add the MCP for this proxy to Claude CLI, Codex CLI — or chat here? Claude CLI
✔ MCP ninopizzak9x2 added to Claude CLI
$ claude -p "Is there a table for 2 tonight at 8pm at Nino Pizza?"
✓ listReservations (312ms)
Yes — a table is available at 8:00pm at Nino Pizza. Want me to book it?

Chat with your API

An OpenAPI spec becomes a serverless proxy, an MCP server, and a chat — humans and agents use it in one command.

Add “Get an API key” to your dev page

Drop one white-label widget on your site and your users mint their own API keys — zero auth code written.

Users, Groups & AuthZ for your API

Object-level authorization enforced at the proxy — OWASP #1 (BOLA), fixed in a blaze.

Chat Keys Users, Groups & Authorization
Chat with your API, on your own site

Chat with your API

One command turns your OpenAPI spec into a live proxy, an MCP server, and a chat. One React component puts that chat on your own site — your users book, query, and act by typing a sentence, and every step runs live through your API.

app/chat/page.tsx
import { ChatWidget } from 'apiblaze/react';

<ChatWidget
  endpoint="/api/apiblaze/chat"
  title="Chat with Nino" avatar="🍕"
  suggestions={['Book a table for 2 tonight']}
/>
Read the widget docs
ninopizzas.com

Nino’s Pizza

Wood-fired. Neapolitan. Midtown.

Margherita
Diavola
Quattro
Chat with Nino✕
Book a table for 2 tomorrow at 8pm
Checking availability
Creating reservation
Done! Table for 2, tomorrow 8:00 pm — see you at Nino's 🍕
Ask something…
➤

▲ the drop-in <ChatWidget/> — tools run live behind your proxy, white-labelled to your brand

Add “Get an API key” on your API dev page

Your users get API keys — from your website in seconds

Drop one React component on your own site and your signed-in users self-serve their API keys — create, rotate, revoke. It talks only to your backend; it never touches ours. Fully white-label through a theme prop.

acme.dev/developers

Developer

API access

Create a key to call the Acme API from your app or CI.

Your API keys
yJt••••••z7r
Created 7/13/2026 · Never used
prod
Aq0••••••tbX
Created 7/13/2026 · Never used
prod
6Cl••••••E5z
Created 7/13/2026 · Never used
prod

▲ the drop-in <ApiKeyWidget/>, white-labelled to your brand

app/keys/page.tsx
import { ApiKeyWidget } from 'apiblaze/react';
export default function Page() {
  return <ApiKeyWidget theme={{ accent: '#7C3AED' }} />;
}
  • import { ApiKeyWidget } from 'apiblaze/react' — mount the route from apiblaze/server
  • Create · rotate · revoke, scoped per environment — masked, copy-once secrets
  • open or invite-only signup, one switch — and keys can bind to your existing login
Read the widget docs
Users, Groups & AuthZ for your API

Users, groups & authorization — in a blaze

Drop one more React component on your site and your customers’ admins manage their own users & groups — nest a group inside a group — from your page. Then one plain-English rule enforces object-level access at the proxy, in front of your unchanged backend. This closes the OWASP #1 vulnerability (Broken Object-Level Authorization) without a line of code in your backend.

acme.dev/team

Workspace

Team access

Your customer’s admins manage their own users & groups — on your site.

Users & groups
▸Admins2 admins
▾front-desk3 members
alice@acme.commember
maria@acme.commember
subgroups:reservationists
Search users to add…
▸Seen in traffic3 new

▲ the drop-in <UsersGroupsWidget/>, white-labelled to your brand

app/team/page.tsx
import { UsersGroupsWidget } from 'apiblaze/react';
export default function Page() {
  return <UsersGroupsWidget theme={{ accent: '#7C3AED' }} />;
}
  • Drop <UsersGroupsWidget/> on your site — the SAME widget key as <ApiKeyWidget/>, one credential for both
  • Customer admins self-serve: users, nested groups, co-admins, and provisioning identities seen in traffic
  • Nested groups walk the tree (OpenFGA); one plain-English rule per resource, shadow-tested before you enforce
Explore authorization

Manage groups in the widget or the CLI — then one plain-English rule resolves the whole tree at the proxy:

npx apiblaze — authorization, enforced at the proxy

# 1 · a proxy where every caller signs in — and what they create is theirs

$ npx apiblaze create --target api.reserv.io/openapi.yaml

? prevent unauthorized users from taking unauthorized actions? Y

✓ live · callers sign in with GitHub · only a reservation's creator (or an admin) can change it

# 2 · a reservation is created BY a user — the proxy records who

$ curl -X POST …/reservations -H "Authorization: Bearer $TOKEN" # john's login

✓ 201 · owner = john (captured at the proxy)

# keys instead? apikeys mint --tenant reserv --for john@… counts as john · a shared key sends X-End-User-Id: john

# 3 · build groups — from the widget above, or the CLI / CI

$ npx apiblaze group create admin

$ npx apiblaze group add-user maria reservationists

$ npx apiblaze group add-group reservationists admin # nest a group in a group

# 4 · one rule in plain English — shadow-tested, then enforce

$ npx apiblaze rule "users see only their own

reservations; children of admin see all" reserv --enforce

# OpenFGA walks the relationship tree:

GET /reservations/42 # john · owner → 200

GET /reservations/42 # alice · nobody → 403

GET /reservations/42 # maria ∈ reservationists ⊂ admin → 200

groups:admin⊃reservationistsenforcing

Three commands. Zero infrastructure.

No infrastructure to maintain. Your backend never changes. No signup to try.

Chat01
npx apiblaze apichat --target ./openapi.yaml

Turn a spec into a live serverless proxy + MCP server + chat you can talk to right now.

Keys02
<ApiKeyWidget /> on your dev page

Your users self-serve API keys from your own site — no portal detour, no auth code.

Users & groups03
npx apiblaze rule "…own rows only"

Object-level authorization enforced at the proxy, in front of your API.

The AI-ready serverless proxy — in one command

No signup required to try. Claim it to your account whenever you’re ready.

$ npx apiblaze apichat
Start free Get the CLI