Ship an API in one command

$ npx apiblaze apichat --target https://apiblaze.com/pokeapi_openapi.yaml

  ✓ proxy live  → https://pokeapi4821.tryabz.run/1.0.0/prod
  ✓ MCP server  → pokeapi4821.mcp.apiblaze.com

you › what types is ditto?
agent › GET /api/v2/pokemon/ditto … → Ditto is a Normal-type Pokémon.
        (the exact curl for every call is printed above each answer)

$ npx apiblaze init          # in your Next.js app; wires the sidecar + dev inspector
$ npm run dev

[apiblaze/sidecar] active — approved origins route through APIblaze; the rest go direct.
[apiblaze/sidecar] direct (not approved) → https://api.stripe.com

$ npx apiblaze sidecar approve api.stripe.com
  ✓ proxy created — api.stripe.com now routes through APIblaze

$ npx apiblaze sidecar deny analytics.example.com    # stop suggesting it
$ npx apiblaze sidecar remove api.stripe.com         # go direct again (deletes the proxy)

$ npx apiblaze agent mcp acme
you › expose search + order lookup as tools
agent › search_products(q, limit)
        get_order(order_id)
/publish
  ✓ Published MCP server — acme-acmecorp.mcp.apiblaze.com/1.0.0/prod

$ npx apiblaze agent                      # general: describe what you want, it makes the calls
$ npx apiblaze agent openapi acme         # drafts your OpenAPI spec from real captured traffic,
                                          #   then /publish — or opens a GitHub PR to your repo
$ npx apiblaze agent authz acme           # drafts access rules, tests them on real
                                          #   traffic watch-only, /enable to enforce
$ npx apiblaze agent mcp acme             # picks routes to become MCP tools, /publish

curl -sX POST https://api.apiblaze.com/proxy \
  -H 'content-type: application/json' \
  -d '{
  "target": "https://pokeapi.co",
  "name": "pokeproxy"
}'

curl -sX POST https://api.apiblaze.com/proxy \
  -H 'content-type: application/json' \
  -d '{
  "target": "https://api.example.com",
  "requests_auth": { "mode": "passthrough" }
}'

# without --apikey, create sets up sign-in and mints NO key — this flag is how you ask for keys
$ npx apiblaze create --target https://api.example.com --apikey

  ✓ Live → https://bravotiger4821.tryabz.run/1.0.0/prod
    API key (prod):  sk_prod_…        # also minted for dev & test

# issue a key to one named person — calls made with it count as them:
$ npx apiblaze apikeys mint --tenant acme --for alice@example.com

# custom key types / identified-only: use the curl tab or --config

$ npx apiblaze create --target https://api.example.com \
    --oauth '{"iss":"https://login.acme.com/","aud":"acme-api","jwks":"https://login.acme.com/.well-known/jwks.json"}'

# APIblaze-hosted GitHub sign-in (managed — nothing to register). This is what create
# does with no auth flag at all; --oauth just spells it out.
$ npx apiblaze create --target https://api.example.com --oauth

# YOUR hosted login: the proxy trusts your JWT issuer
$ npx apiblaze create --target https://api.example.com \
    --oauth '{"iss":"https://login.acme.com/","aud":"acme-api","jwks":"https://login.acme.com/.well-known/jwks.json"}'

# APIblaze-hosted login page with YOUR OAuth app (github · google · microsoft · facebook · auth0)
$ npx apiblaze create --target https://api.example.com \
    --oauth '{"provider":"google","clientId":"xxxx.apps.googleusercontent.com","clientSecret":"GOCSPX-xxxx"}'

curl -sX POST https://api.apiblaze.com/proxy \
  -H 'content-type: application/json' \
  -d '{
  "target": "https://api.example.com",
  "requests_auth": {
    "mode": "authenticate",
    "methods": ["opaque"],
    "opaque": {
      "endpoint": "https://auth.example.com/introspect",
      "method": "POST",
      "params": "?access_token={token}",
      "body": "token={token}"
    }
  }
}'

$ npx apiblaze create --target ./openapi.yaml --name nino

? How should callers sign in?  Sign in with an account (OAuth)      # default · --apikey for keys
? Do you want to prevent unauthorized users from taking unauthorized actions? (Y/n)  Y
? Which of these do you want on?  (space toggles · a = all · enter accepts)
  ◉ Only the person who created a reservation — or an admin — can view, change or delete it.
  ◉ Only the person who created an order — or an admin — can view, change or delete it.
? Who is the admin? Their email:  you@example.com

  ✓ Live → https://nino.abz.run/1.0.0/dev   · callers sign in with GitHub
  ✓ Ownership rules ON for reservations, orders — enforcing
  ✓ you@example.com added as admin — active on their first sign-in

# try it — log in as a user of the API, then call it with the token
$ TOKEN=$(npx apiblaze consumer login --tenant nino >/dev/null && npx apiblaze consumer tokens --json | jq -r .access_token)
$ curl https://nino.abz.run/1.0.0/dev/reservations -H "Authorization: Bearer $TOKEN"

# changed your mind? this turns the rules off (they stay saved):
$ npx apiblaze config nino authorization.enforce_authorization false

$ npx apiblaze rule "users see only their own reservations; \
    managers see all" reserv

  ✓ rule created — watch-only for now:
    reporting what it WOULD block, blocking nothing

# happy with the report? turn it on:
$ npx apiblaze rule "…" reserv --enforce

GET /reservations/42   # john  · owner        → 200
GET /reservations/42   # alice · nobody       → 403
GET /reservations/42   # maria ∈ managers     → 200

curl -sX POST https://policies.apiblaze.com/1.0.0/prod/v1/check \
  -H 'x-api-key: sk_prod_…' \
  -H 'content-type: application/json' \
  -d '{ "tuples": [ { "user": "user:john", "relation": "owner", "object": "reservation:42" } ] }'

# → { "results": [ { "allowed": true } ], "all_allowed": true }

curl -sX POST https://policies.apiblaze.com/1.0.0/prod/v1/write \
  -H 'x-api-key: sk_prod_…' \
  -H 'content-type: application/json' \
  -d '{ "writes": [ { "user": "user:john", "relation": "owner", "object": "reservation:42" } ] }'

# to remove it later, send the same shape under "deletes"

curl -sX POST https://policies.apiblaze.com/1.0.0/prod/v1/list-objects \
  -H 'x-api-key: sk_prod_…' \
  -H 'content-type: application/json' \
  -d '{ "user": "user:john", "relation": "owner", "object_type": "reservation" }'

# → { "objects": ["42", "77"], "count": 2 }

$ npx apiblaze throttle myapi --rate 10 --quota 10000 --period daily
  ✓ userRateLimit=10 r/s · proxyQuota=10000/daily

# add --verbose to any command to see the exact API calls it makes

$ npx apiblaze create --target https://api.example.com --oauth

# the same as plain `npx apiblaze create --target https://api.example.com` — no API key is minted

$ npx apiblaze create --target https://api.example.com \
    --oauth '{"provider":"google","clientId":"xxxx.apps.googleusercontent.com","clientSecret":"GOCSPX-xxxx"}'

# providers: github · google · microsoft · facebook · auth0
# advanced (token types, scopes, callback URLs): use the curl tab or --config

# add a 2.0.0 alongside the existing 1.0.0 (serves at /2.0.0/…)
$ npx apiblaze create --name myapi --target https://api-v2.example.com --apiversion 2.0.0

# point one environment somewhere else
$ npx apiblaze target myapi --env dev --url https://dev.example.com

# choose which version/environment the bare domain serves
$ npx apiblaze domain set-base myapi

$ npx apiblaze domain add myapi
  → set this DNS record at your provider:
    CNAME  api.yourcompany.com  →  <shown-target>.apiblaze.com

$ npx apiblaze domain status myapi
  api.yourcompany.com   ✓ TLS issued · ✓ active

$ npx apiblaze domain list myapi          # all custom domains for a proxy
$ npx apiblaze domain rm myapi            # remove one

curl -sX POST https://api.apiblaze.com/proxy \
  -H 'content-type: application/json' \
  -d '{
  "openapi": "<full OpenAPI YAML or JSON document as a string>"
}'

$ curl -sX POST https://api.apiblaze.com/proxy \
    -H 'content-type: application/json' \
    -d '{ "target": "https://pokeapi.co" }'
{
  "project_id": "bravotiger4821",
  …
  "claim_url": "https://dashboard.apiblaze.com/claim?claimCode=G7QN-…"
}

npx apiblaze apichat --target <url|file>      # chat with any API, no login
npx apiblaze create --target https://pokeapi.co   # go live behind GitHub sign-in, no signup
npx apiblaze create --target ./openapi.yaml       # …from a spec: also offers to lock down what people create
npx apiblaze create --target https://pokeapi.co --apikey   # …with API keys instead of sign-in
npx apiblaze rule myapi                           # review / change the ownership rules
npx apiblaze init                                 # sidecar into a Next.js app
npx apiblaze dev 3000                             # tunnel localhost, stream traffic
npx apiblaze login && npx apiblaze claim          # claim it to your account
npx apiblaze config myapi                         # browse & change EVERY setting

# the hosted portal — login, self-serve keys, try endpoints live
https://{project}.portal.apiblaze.com/{version}

# or from the terminal:
$ npx apiblaze consumer login       # device-flow login to a tenant's portal
$ npx apiblaze consumer apikeys     # list keys (reveals expiring ones), offer to create
$ npx apiblaze consumer tokens      # show the access / refresh / id tokens