APIblaze：内置全套能力的无服务器 MCP 与 API 网关

npx apiblaze@latest skills · no signup

Serverless MCP & API GatewayEverything built-in for human and agent traffic

Secured MCP
Multi-tenant
Self-serve API keys
OAuth sign-in
Authorization
Throttling & quotas
Localhost tunneling
Custom domains

One prompt. No sign-up needed.Your MCP & API ready.

Your app goes behind a proxy and an MCP that bring everything production needs: multi-tenant, authentication (self-service API keys and OAuth), authorization with users and groups. In seconds.

Ask your agent to use APIblaze to ready your backend for launch

~/code/mybackend $ npm run dev

⚡️ My app: A restaurant table booking app, running on localhost:3000

GET /reservations/{id} Get one booking

DELETE /reservations/{id} Cancel a booking

POST /reservations Book a table

~/code/mybackend $

Enable chat with your API, on your own site

Enable chat with your API

One command turns your OpenAPI spec into a live proxy, an MCP server, and a chat. One React component puts that chat on your own site — your users book, query, and act by typing a sentence, and every step runs live through your API.

app/chat/page.tsx

import { ChatWidget } from 'apiblaze/react';

<ChatWidget
  endpoint="/api/apiblaze/chat"
  title="Chat with Nino" avatar="🍕"
  suggestions={['Book a table for 2 tonight']}
/>

Read the widget docs

ninopizzas.com

Nino’s Pizza

Wood-fired. Neapolitan. Midtown.

Margherita

Diavola

Quattro

Chat with Nino✕

Book a table for 2 tomorrow at 8pm

Checking availability

Creating reservation

Done! Table for 2, tomorrow 8:00 pm — see you at Nino's 🍕

Ask something…

➤

▲ the drop-in <ChatWidget/> — tools run live behind your proxy, white-labelled to your brand

Add “Get an API key” on your API dev page

Your users get API keys — from your website in seconds

Drop one React component on your own site and your signed-in users self-serve their API keys — create, rotate, revoke. It talks only to your backend; it never touches ours. Fully white-label through a theme prop.

acme.dev/developers

Developer

API access

Create a key to call the Acme API from your app or CI.

yJt••••••z7r

Created 7/13/2026 · Never used

prod

Aq0••••••tbX

Created 7/13/2026 · Never used

prod

6Cl••••••E5z

Created 7/13/2026 · Never used

prod

▲ the drop-in <ApiKeyWidget/>, white-labelled to your brand

app/keys/page.tsx

import { ApiKeyWidget } from 'apiblaze/react';
export default function Page() {
  return <ApiKeyWidget theme={{ accent: '#7C3AED' }} />;
}

import { ApiKeyWidget } from 'apiblaze/react' — mount the route from apiblaze/server
Create · rotate · revoke, scoped per environment — masked, copy-once secrets
open or invite-only signup, one switch — and keys can bind to your existing login

Read the widget docs

Users, Groups & AuthZ for your API

Users, groups & authorization — in a blaze

Drop one more React component on your site and your customers’ admins manage their own users & groups — nest a group inside a group — from your page. Then one plain-English rule enforces object-level access at the proxy, in front of your unchanged backend. This closes the OWASP #1 vulnerability (Broken Object-Level Authorization) without a line of code in your backend.

ninopizzas.com/team

Workspace

Team access

Your customer’s admins manage their own users & groups — on your site.

Users & groups

Users 3Groups 2Admins 2

+ Add user

Ana Moretti

ana@ninopizzas.com

Ben Russo

ben@ninopizzas.com

Chiara Esposito

chiara@ninopizzas.com

3 people have called your API but aren’t users yet.Review and add →

▲ the drop-in <UsersGroupsWidget/>, white-labelled to your brand

app/team/page.tsx

import { UsersGroupsWidget } from 'apiblaze/react';
export default function Page() {
  return <UsersGroupsWidget theme={{ accent: '#7C3AED' }} />;
}

Drop <UsersGroupsWidget/> on your site — the SAME widget key as <ApiKeyWidget/>, one credential for both
Customer admins self-serve: users, nested groups, co-admins, and provisioning identities seen in traffic
Nested groups walk the tree (OpenFGA); one plain-English rule per resource, shadow-tested before you enforce

Explore authorization

Manage groups in the widget or the CLI — then one plain-English rule resolves the whole tree at the proxy:

npx apiblaze — authorization, enforced at the proxy

# 1 · groups, in the widget above or from the CLI

$ npx apiblaze group create admin

$ npx apiblaze group create staff

$ npx apiblaze group add-group staff admin # staff sits inside admin

$ npx apiblaze group add-user maria staff

# 2 · one rule, in plain English: tried in shadow mode, then enforced

$ npx apiblaze rule reserv \

"users see only their own reservations; anyone in admin sees all"

# 3 · every call is checked at the proxy enforcing

GET /reservations/42 john his own → 200

GET /reservations/42 alice not hers, not in admin → 403

GET /reservations/42 maria staff, inside admin → 200

Three commands. Zero infrastructure.

No infrastructure to maintain. Your backend never changes. No signup to try.

Create01

npx apiblaze create --target https://ninopizzas.com/openapi.yaml

A spec becomes a live serverless proxy + MCP server, locked down from the spec. Say yes at the end and you are chatting with it.

Keys02

<ApiKeyWidget /> on your dev page

Your users self-serve API keys from your own site — no portal detour, no auth code.

Users & groups03

npx apiblaze rule "Only admins can…"

Object-level authorization enforced at the proxy, in front of your API.

Your MCP & API gateway, in one command

No signup required to try. Claim it to your account whenever you’re ready.

$ npx apiblaze create --target https://ninopizzas.com/openapi.yaml

Start free Get the CLI