APIblazeAPIblaze
Roles and groups for your API and MCP server

How to control access to your API by users and by groups?

Put people in groups, decide what each group may do, and check it on every request. At a restaurant, managers change any booking, waiters only view them, and customers touch only their own.

That is easy to describe and slow to build well. Here’s what it takes, and the easy way to solve it.

Skip to the one-command way
1 Why it’s hard

Simple to describe, weeks to build

Groups look like two database tables. The work is everything around them: a list of everyone who uses your API, groups inside groups, an admin for each of your customers, a screen for those admins, and a check on every request. Built by one developer, piece by piece, it looks like this.

  1. A list of everyone who uses your API2–4 days
  2. Groups like managers and waiters2–3 days
  3. Groups inside groups1–3 days
  4. An admin for each customer3–5 days
  5. A screen to manage it all1–2 weeks
  6. Requests to join a group2–4 days
  7. Whole-company sign-in1–2 days
  8. A check on every request, AI included1–2 weeks
  9. Telling your code who is calling1 day
Build estimates for roles and groups, one experienced developer
PieceEstimate
A list of everyone who uses your API2–4 days
Groups like managers and waiters2–3 days
Groups inside groups1–3 days
An admin for each customer3–5 days
A screen to manage it all1–2 weeks
Requests to join a group2–4 days
Whole-company sign-in1–2 days
A check on every request, AI included1–2 weeks
Telling your code who is calling1 day
Rough estimates for one experienced developer, testing included, one piece after another: about 6.5 weeks, and 1–2 months at the outside. Hover a bar to see why.

And one forgotten check undoes all of it

Even once it’s built, every endpoint and every MCP tool has to check the role itself. The check gets copied into every file, and the one you forget is the one an AI assistant finds.

Built by hand: the check is copied into every file

bookings.ts

checked

if (!isManager(user)) return deny();

updateBooking(id);

reports.ts

checked

if (!isManager(user)) return deny();

buildReport();

mcp/tools.ts

forgot the check

// no check here

cancelBooking(id);

Ana’s AI assistantcancel_bookingmcp/tools.tscancelled Ben’s booking. It should have been refused.
There’s a shorter way.
2 The shortcut

Turn on users and groups with one command

APIblaze already runs every piece on that list. Point it at your API and switch users and groups on:

Get users and groups on your API

$ npx apiblaze@latest create --target https://ninopizzas.com/openapi.yaml --iam

Paste it in a terminal. No sign-up, no servers. The link is a sample restaurant API; swap in your own API’s address. --iam turns users and groups on. Your code doesn’t change.

How can one command do all that without touching your code?
3 Why it works

APIblaze is an API proxy: every request passes through it first

It sits between the people using your API and your API itself. Your app, a partner or an AI assistant calls APIblaze, and APIblaze passes on only the calls that are allowed.

Callers

  • Chiara, a managerasks to change a booking
  • Ana, a waiterasks to change a booking
  • Ana’s AI assistantasks to cancel a booking

APIblaze

The API proxy

Checks each caller’s group against your rules before the call reaches your code.

Same rules as Ana

Your API

Only sees the calls APIblaze lets through.

Never reached your code.

That’s why it’s the right place for roles. The check lives in one spot that every request has to pass, so no endpoint and no MCP tool can be forgotten.

With APIblaze: one rule, in one place, in front of everything

APIblaze“Managers can change or cancel any booking. Everyone else, only their own.”

bookings.ts

covered

updateBooking(id);

reports.ts

covered

buildReport();

mcp/tools.ts

covered

cancelBooking(id);

Ana’s AI assistantcancel_bookingAPIblazerefused. Your code never ran.
Here is what setting it up looks like.
4 How to do it

Roles and groups on your API, step by step

  1. 1

    Turn on users and groups

    The command above does it. Everyone who signs in lands in one directory: with GitHub out of the box, or with your own login like Google, Microsoft or Auth0.

  2. 2

    Write the rule in plain English

    APIblaze turns the sentence into a check, and saves it in watch-only mode first, so you see what it would block before it blocks anything.

    $ npx apiblaze@latest rule myapi "Only managers can change reservations"
  3. 3

    Let each customer run their own team

    Make each customer’s manager their admin. From then on every hire, leaver and promotion is handled by them, not by you. Here is one restaurant, Nino’s Pizza: approve Luca’s request and watch the tree.

    $ npx apiblaze@latest admins add chiara@ninopizzas.com --tenant ninos

    Nino’s Pizza

    one of your customers · admin: Chiara

    • Managers

      CE

      can change any booking

    • Staff

      can view every booking

      • Waiters

        AMBRPB

        can view every booking, from Staff

      • Kitchen

        GR

        can view every booking, from Staff

    Without APIblaze: your inbox

    chiara@ninopizzas.com

    “Hi! Can you add Luca as a waiter? And remove Paul, he left last week.”

    Every hire, every leaver, every customer: it lands with you.

    With APIblaze: Chiara handles it

    Her email

    Luca asked to join Waiters

    The user and group administration page on your site

    PB

    PaulWaiters

    Done in seconds, by the person who knows her team. You never hear about it.

    Groups inside groups

    Waiters and Kitchen sit inside Staff, so one rule for Staff covers both.

    Promote by moving

    Move Ana into Managers and she can change any booking, live within a minute, no redeploy.

    Each customer, their own tree

    Nino’s admin sees Nino’s groups, and no other restaurant’s.

  4. 4

    Give those admins a screen, already built

    One React component on your site gives every customer’s admin their users, groups and co-admins.

    ninopizzas.com/admin

    Workspace

    User and group administration

    Your customer’s admins manage their own users & groups — on your site.

    Users & groups
    Users 3Groups 2Admins 2
    + Add user
    AM
    Ana Moretti
    ana@ninopizzas.com
    BR
    Ben Russo
    ben@ninopizzas.com
    CE
    Chiara Esposito
    chiara@ninopizzas.com
    3 people have called your API but aren’t users yet.Review and add →

    ▲ the drop-in <UsersGroupsWidget/>, white-labelled to your brand

    app/admin/page.tsx
    import { UsersGroupsWidget } from 'apiblaze/react';

export default function AdminPage() {
  return <UsersGroupsWidget theme={{ accent: '#7C3AED' }} />;
}

    How the widget works

  5. 5

    See the result, one role at a time

    A manager, a waiter and a customer ask their AI assistant the same thing. Only the role changes the answer.

    CE

    Chiara

    Manager

    Show me every booking

    list_bookingsGET /bookings · allowed

    Here are all 248 bookings.

    AM

    Ana

    Waiter

    Show me every booking

    list_bookingsGET /bookings · allowed

    Here are all 248 bookings.

    MR

    Marco

    Customer

    Show me every booking

    list_bookingsGET /bookings · only their own

    Here are your 2 bookings.

    1/4

    Same question, same tool, same API. Only the role changes, and APIblaze checks it before the request reaches your code.

    What each role can do
    RequestManagerWaiterCustomer
    Show me every bookingAllowedAllowedAllowed
    Move Ben’s booking to 8pmAllowedRefusedRefused
    Make my booking a table for 4AllowedAllowedAllowed
    Cancel Ben’s bookingAllowedRefusedRefused
Every command on this page, in one list

  1. Turn on roles and groups for your API

    $ npx apiblaze@latest create --target ./openapi.yaml --iam

  2. Write a rule in plain English

    $ npx apiblaze@latest rule myapi "Only managers can change reservations"

  3. Make Chiara the admin for Nino’s

    $ npx apiblaze@latest admins add chiara@ninopizzas.com --tenant ninos

  4. Create the Waiters group

    $ npx apiblaze@latest group create waiters

  5. Put Waiters inside Staff

    $ npx apiblaze@latest group add-group waiters staff

  6. Add Luca to Waiters

    $ npx apiblaze@latest group add-user luca@ninopizzas.com waiters

  7. Remove Paul

    $ npx apiblaze@latest group remove-user paul@ninopizzas.com waiters

  8. Let the whole restaurant sign in, straight into Staff

    $ npx apiblaze@latest preapprove ninopizzas.com --group staff

  9. See everyone, including people seen in your traffic

    $ npx apiblaze@latest group users

Common questions

How do I manage users and groups on my API?

You need a list of users, groups with members, an admin for each customer, a screen to manage them, and a check on every request. You can build each piece yourself, or put APIblaze in front of your API: one command adds users and groups, and one React component gives your customers the screen.

What is the difference between users, groups and roles?

A user is one person. A group is a set of people, like “staff”. A role is what a group may do, like “can change any booking”. In APIblaze you put people in groups and write rules about what each group may do.

What is an API proxy?

A service that sits in front of your API. Every request goes through it first, so it can check who is calling and what they may do before your code runs. APIblaze is an API proxy.

Do groups apply to AI assistants using my MCP server?

Yes. An assistant using your MCP server acts as the person who signed in, with that person’s groups, so the same rules apply. You don’t write separate rules for AI.

Can my customers manage their own users?

Yes. Make someone the admin for their company, and they add people, groups and other admins from the ready-made screen on your site. They only ever see their own company.

Can a group contain another group?

Yes. Put “waiters” inside “staff”, and waiters can do everything staff can. Rules follow the whole tree.

How does my code know who is calling?

Every request reaches your code with the caller and their groups, signed by APIblaze, so you can trust it without looking anything up.

Does it work with my existing login?

Yes. People sign in with GitHub out of the box, or with your own login: Google, Microsoft, Auth0 or any OpenID Connect provider.

Give your API users and groups today

One command, no sign-up. Your code doesn’t change.

$ npx apiblaze@latest create --target https://ninopizzas.com/openapi.yaml --iam
Using an AI coding assistant? Paste this into Claude Code or Codex:Add users and groups to my API using npx apiblaze@latest skills
Read more:OAuth for Claude connectors Host a remote MCP server Scoped API keys Rate limits and quotas Multi-tenant APIs Per-record access Groups Users and groups widget Authorization rules Docs