Ship an API in one command

$ npx apiblaze apichat docsdemo1

Chat with your API  · docsdemo1.mcp.abz.run
Ask a question in plain English. /exit to quit · /login for more free chats · /claim to keep this workspace

you › which restaurants are there?
agent › ⚙ list_restaurants…
        ✓ list_restaurants (ok, 412ms)
        …then the answer, in plain English, from what your API actually returned.

# wire it into Claude Code or Codex instead of chatting here:
$ npx apiblaze apichat docsdemo1 --install-mcp claude

$ npx apiblaze apichat --target https://ninopizzas.com/openapi.yaml --name pizzachat

  ✓ proxy  https://pizzachat.tryabz.run/1.0.0/prod
  ✓ mcp    https://pizzachat.mcp.tryabz.run/1.0.0/prod
         Claude/ChatGPT-connectable (GitHub sign-in) · access: open — anyone who signs in can call this API

  Anonymous workspace — /claim inside the chat to log in and keep it beyond 30 days.

Chat with your API  · pizzachat.mcp.tryabz.run
you › which restaurants are there?

$ npx apiblaze init          # in your Next.js app; wires the sidecar + dev inspector
$ npm run dev

[apiblaze/sidecar] active — approved origins route through APIblaze; the rest go direct.
[apiblaze/sidecar] direct (not approved) → https://api.stripe.com · approve to route it: npx apiblaze sidecar approve api.stripe.com

$ npx apiblaze sidecar approve api.stripe.com
  ✔ Approved https://api.stripe.com → proxy scapistripecom3f9a21. Your app will route it within ~5 min.

$ npx apiblaze sidecar deny analytics.example.com   # ✔ Dismissed — it won't be suggested again
$ npx apiblaze sidecar remove api.stripe.com        # ✔ goes direct again (deletes the proxy)
$ npx apiblaze sidecar                                # list what's routed and what's still a candidate

$ npx apiblaze agent mcp acme
you › expose search + order lookup as tools
agent › search_products(q, limit)
        get_order(order_id)
/publish
  ✓ Published MCP server — acme-acmecorp.mcp.apiblaze.com/1.0.0/prod

$ npx apiblaze agent                      # general: describe what you want, it makes the calls
$ npx apiblaze agent openapi acme         # drafts your OpenAPI spec from real captured traffic,
                                          #   then /publish — or opens a GitHub PR to your repo
$ npx apiblaze agent authz acme           # drafts access rules, tests them on real
                                          #   traffic watch-only, /enable to enforce
$ npx apiblaze agent mcp acme             # picks routes to become MCP tools, /publish

curl -sX POST https://api.apiblaze.com/proxy \
  -H 'content-type: application/json' \
  -d '{
  "target": "https://pokeapi.co",
  "name": "pokeproxy"
}'

curl -sX POST https://api.apiblaze.com/proxy \
  -H 'content-type: application/json' \
  -d '{
  "target": "https://api.example.com",
  "auth_type": "api_key",
  "requests_auth": { "mode": "authenticate", "methods": ["api_key", "jwt"] },
  "login": { "providers": [{ "type": "github", "managed": true }] }
}'

# the bootstrap keys ARE minted (one per environment) AND the GitHub sign-in is
# provisioned. Add "preapproved_users_only": true inside requests_auth to let in
# only you and the emails you pre-approve.

curl -sX POST https://api.apiblaze.com/proxy \
  -H 'content-type: application/json' \
  -d '{
  "target": "https://api.example.com",
  "requests_auth": { "mode": "passthrough" }
}'

# keys are minted either way. --apikey is how you say "key only, no GitHub sign-in".
$ npx apiblaze create --target https://api.example.com --apikey

  ✓ https://myapi.abz.run/1.0.0/dev — callers send the API key (X-API-Key) — no sign-in
  API key (for your backend and widget — shown once, save it now):
    sk_dev_…                          # also minted for test & prod

# issue a key to one named person — calls made with it count as them:
$ npx apiblaze apikeys mint --tenant acme --for alice@example.com

# custom key types / identified-only: use the curl tab or --config

$ npx apiblaze create --target https://api.example.com \
    --oauth '{"iss":"https://login.acme.com/","aud":"acme-api","jwks":"https://login.acme.com/.well-known/jwks.json"}'

# APIblaze-hosted GitHub sign-in (managed — nothing to register), and NO API key:
# --oauth closes the key door that create opens by default.
$ npx apiblaze create --target https://api.example.com --oauth

# YOUR hosted login: the proxy trusts your JWT issuer
$ npx apiblaze create --target https://api.example.com \
    --oauth '{"iss":"https://login.acme.com/","aud":"acme-api","jwks":"https://login.acme.com/.well-known/jwks.json"}'

# APIblaze-hosted login page with YOUR OAuth app (github · google · microsoft · facebook · auth0)
$ npx apiblaze create --target https://api.example.com \
    --oauth '{"provider":"google","clientId":"xxxx.apps.googleusercontent.com","clientSecret":"GOCSPX-xxxx"}'

curl -sX POST https://api.apiblaze.com/proxy \
  -H 'content-type: application/json' \
  -d '{
  "target": "https://api.example.com",
  "requests_auth": {
    "mode": "authenticate",
    "methods": ["opaque"],
    "opaque": {
      "endpoint": "https://auth.example.com/introspect",
      "method": "POST",
      "params": "?access_token={token}",
      "body": "token={token}"
    }
  }
}'

# 1. Listing a collection stays open to anyone who gets in.
$ curl https://docsdemo1.abz.run/1.0.0/dev/restaurants \
    -H "X-API-Key: sk_dev_…" -H "X-End-User-Id: you"
  → 200   [ … ]

# 2. Creating is open too — that POST is how the proxy learns who owns the new thing.
$ curl -X POST https://docsdemo1.abz.run/1.0.0/dev/restaurants \
    -H "X-API-Key: sk_dev_…" -H "X-End-User-Id: ana" \
    -H 'content-type: application/json' \
    -d '{"slug":"ana-trastevere","name":"Ana Trastevere"}'
  → 201   { "id": "…", "slug": "ana-trastevere", … }

# 3. Ana created it, so Ana can read it back.
$ curl https://docsdemo1.abz.run/1.0.0/dev/restaurants/ana-trastevere \
    -H "X-API-Key: sk_dev_…" -H "X-End-User-Id: ana"
  → 200   { "slug": "ana-trastevere", … }

# 4. Same key, same URL, different person → refused. Your backend did not change.
$ curl https://docsdemo1.abz.run/1.0.0/dev/restaurants/ana-trastevere \
    -H "X-API-Key: sk_dev_…" -H "X-End-User-Id: ben"
  → 403

# no sentence = the same checkbox create showed you. Free, and not a chat.
$ npx apiblaze rule docsdemo1

# a sentence = an LLM turn, billed. The project still comes first.
$ npx apiblaze rule docsdemo1 "users see only their own reservations; managers see all"

  ✓ rule created — watch-only for now:
    reporting what it WOULD block, blocking nothing

# happy with the report? turn it on:
$ npx apiblaze rule docsdemo1 "users see only their own reservations; managers see all" --enforce

GET /restaurants/nino/reservations/42   # john  · owner        → 200
GET /restaurants/nino/reservations/42   # alice · nobody       → 403
GET /restaurants/nino/reservations/42   # maria ∈ managers     → 200

curl -sX POST https://policies.apiblaze.com/1.0.0/prod/v1/check \
  -H 'x-api-key: sk_prod_…' \
  -H 'content-type: application/json' \
  -d '{ "tuples": [ { "user": "user:john", "relation": "owner", "object": "reservation:42" } ] }'

# → { "results": [ { "allowed": true } ], "all_allowed": true }

curl -sX POST https://policies.apiblaze.com/1.0.0/prod/v1/write \
  -H 'x-api-key: sk_prod_…' \
  -H 'content-type: application/json' \
  -d '{ "writes": [ { "user": "user:john", "relation": "owner", "object": "reservation:42" } ] }'

# to remove it later, send the same shape under "deletes"

curl -sX POST https://policies.apiblaze.com/1.0.0/prod/v1/list-objects \
  -H 'x-api-key: sk_prod_…' \
  -H 'content-type: application/json' \
  -d '{ "user": "user:john", "relation": "owner", "object_type": "reservation" }'

# → { "objects": ["42", "77"], "count": 2 }

$ npx apiblaze throttle myapi --rate 10 --quota 10000 --period daily
  ✓ userRateLimit=10 r/s · proxyQuota=10000/daily

# --end-user-rate is a fairness sub-limit INSIDE one credential: with a shared
# backend key, no single X-End-User-Id can starve the others.
$ npx apiblaze throttle myapi --end-user-rate 2

# add --verbose to any command to see the exact API calls it makes

$ npx apiblaze create --target https://api.example.com --oauth

  ✓ https://myapi.abz.run/1.0.0/dev — callers use an APIblaze login (with GitHub) — no API key

# plain `npx apiblaze create --target https://api.example.com` provisions the SAME GitHub
# sign-in and mints the bootstrap API keys as well. --oauth is how you drop the keys.

$ npx apiblaze create --target https://api.example.com \
    --oauth '{"provider":"google","clientId":"xxxx.apps.googleusercontent.com","clientSecret":"GOCSPX-xxxx"}'

# providers: github · google · microsoft · facebook · auth0
# advanced (token types, scopes, callback URLs): use the curl tab or --config

# add a 2.0.0 alongside the existing 1.0.0 (serves at /2.0.0/…)
$ npx apiblaze create --name myapi --target https://api-v2.example.com --apiversion 2.0.0

# point one environment somewhere else
$ npx apiblaze target myapi --env dev --url https://dev.example.com

# choose which version/environment the bare domain serves
$ npx apiblaze domain set-base myapi

$ npx apiblaze domain add myapi
  → set this DNS record at your provider:
    CNAME  api.yourcompany.com  →  <shown-target>.apiblaze.com

$ npx apiblaze domain status myapi
  api.yourcompany.com   ✓ TLS issued · ✓ active

$ npx apiblaze domain list myapi          # all custom domains for a proxy
$ npx apiblaze domain rm myapi            # remove one

curl -sX POST https://api.apiblaze.com/proxy \
  -H 'content-type: application/json' \
  -d '{
  "openapi": "<full OpenAPI YAML or JSON document as a string>"
}'

  ⚠ Anonymous — claim within 30 days or it expires. To claim these proxies:
      npx apiblaze login && npx apiblaze claim G7QN-62JB-VN3D-RQNR-F6EZ

# on the machine that created them you can drop the code — the CLI remembers:
$ npx apiblaze login && npx apiblaze claim

# merge into a team you already have instead of promoting a new one:
$ npx apiblaze claim G7QN-62JB-VN3D-RQNR-F6EZ --team my-team

npx apiblaze create --target https://ninopizzas.com/openapi.yaml   # THE command: proxy + MCP,
                                                  #   both doors, resources locked to their creator
npx apiblaze create --target https://pokeapi.co   # no spec? same thing, nothing to lock yet
npx apiblaze create --target https://pokeapi.co --apikey   # …API-key door only, no sign-in
npx apiblaze dev 3000                             # the same, with localhost behind a tunnel
npx apiblaze apichat myapi                        # chat with a proxy you made
npx apiblaze apichat --target <url|file>          # chat with someone else's API, no login
npx apiblaze rule myapi                           # review / change the ownership rules
npx apiblaze integration myapi --stack nextjs     # the snippets to paste into your app
npx apiblaze admins add you@example.com --tenant acme   # who bypasses the rules
npx apiblaze init                                 # sidecar into a Next.js app
npx apiblaze login && npx apiblaze claim          # claim an anonymous workspace
npx apiblaze config myapi                         # browse & change EVERY setting
npx apiblaze docs                                 # ask a chatbot — it can act on your account
npx apiblaze skills --install                     # teach Claude Code to do all of the above

# the hosted portal — login, self-serve keys, try endpoints live. The address names
# the workspace your users live in (the tenant), not the proxy — with the product tag
# in front of it when the proxy has one:
https://{tenant}.portal.apiblaze.com/{version}
https://{product}-{tenant}.portal.apiblaze.com/{version}

# or from the terminal. The first two are the ones create prints in its plan block:
$ npx apiblaze consumer login --tenant portalteststenant   # device-flow login
$ npx apiblaze consumer apikeys     # list keys (reveals expiring ones), offer to create
$ npx apiblaze consumer tokens      # show the access / refresh / id tokens
$ npx apiblaze consumer logs        # stream YOUR OWN requests on this tenant, live